Movable Type 4.2x / 4.3x Web Upgrade Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit4 'Movable Type 4.2x, 4.3x Web Upgrade...

PT-2013-1055

Name of the Vulnerable Software and Affected Versions Movable Type versions 4.2x through 4.38 Description The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely. Specifically, in Movable Type, the lib/MT/Upgrade.pm file in...

CVE-2013-0209: Improper Authentication

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injecti...