Nibbleblog Cross-Site Request Forgery Vulnerability

NibbleBlog is a set of blogging engines. A cross-site request forgery vulnerability exists in Nibbleblog versions prior to 4.0.3 due to an admin.php script that fails to adequately filter newsimple operations and filter the 'content' parameter in newsimple operations. A remote attacker can exploi...

Nibbleblog Arbitrary File Upload Vulnerability

NibbleBlog is a set of blogging engines. An arbitrary file upload vulnerability exists in the My Image plugin for Nibbleblog versions prior to 4.0.3. A remote attacker can exploit this vulnerability by uploading an executable file and sending a direct request to access the file to execute arbitra...

CVE-2015-6967

Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/myimage/image.php...

CVE-2015-6966

Multiple cross-site request forgery CSRF vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that 1 create a post via a newsimple action to admin.php or 2 conduct cross-site scripting XSS attacks via the content parameter i...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that 1 create a post via a newsimple action to admin.php or 2 conduct cross-site scripting XSS attacks via the content parameter i...

Unrestricted file upload

Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/myimage/image.php...

CVE-2015-6966

CVE-2015-6966 concerns a CSRF vulnerability in Nibbleblog prior to version 4.0.5, enabling remote attackers to hijack administrator authentication via a new_simple action to admin.php (including post creation) and to trigger XSS through the content parameter in the same new_simple path. The root ...

CVE-2015-6967

Nibbleblog's My Image plugin vulnerability CVE-2015-6967 affects versions prior to 4.0.5. An unrestricted file upload lets remote attackers upload a file with an executable extension and access it directly at content/private/plugins/my_image/image.php, enabling arbitrary code execution on the ser...

CVE-2015-6966

Multiple cross-site request forgery CSRF vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that 1 create a post via a newsimple action to admin.php or 2 conduct cross-site scripting XSS attacks via the content parameter i...

CVE-2015-6967

Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/myimage/image.php...

NibbleBlog 4.0.3 Shell Upload

NibbleBlog 4.0.3: Code Execution Security Advisory – Curesec Research Team 1. Introduction Affected Product: NibbleBlog 4.0.3 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: Website: http://www.nibbleblog.com/ Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to...

Nibbleblog File Upload Vulnerability

Nibbleblog contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. This module was tested on version 4.0.3. Module Options msf use exploit/multi/http/nibbleblog/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf...

CVE-2014-8996

Multiple cross-site scripting XSS vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 authorname or 2 content parameter to index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 authorname or 2 content parameter to index.php...

CVE-2014-8996

Multiple cross-site scripting XSS vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 authorname or 2 content parameter to index.php...

CVE-2014-8996

Nibbleblog vulnerability CVE-2014-8996: multiple XSS flaws in Nibbleblog

Nibbleblog 4.0.1 Cross Site Scripting Vulnerability

NibbleBlog versions 4.0.1 and below suffer from a cross site scripting vulnerability ============================================= MGC ALERT 2014-002 - Original release date: March 5, 2014 - Last revised: November 17, 2014 - Discovered by: Manuel Garcia Cardenas - Severity: 4,8/10 CVSS Base Score...

Nibbleblog 4.0.1 Cross Site Scripting

============================================= MGC ALERT 2014-002 - Original release date: March 5, 2014 - Last revised: November 17, 2014 - Discovered by: Manuel Garcia Cardenas - Severity: 4,8/10 CVSS Base Score ============================================= I. VULNERABILITY...

Nibbleblog v3.4 (ajax) <= (FD/FU) Multiple Vulnerabilities

Nibbleblog v3.4 is suffer from multiple vulnerabilities / bugs in ajax-Uploader , the attacker can use some bug in the ajax-up plug to Disclosure the Full Path , and the uploader is not protected ! after get admin auth use brute force or any way :p post new image with TamperData Shell-Included an...

Nibbleblog 3 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/48339/info Nibbleblog is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, acce...