Published: 23/01/2013 Updated: 29/01/2013

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x up to and including 4.38 does not require authentication for requests to database-migration functions, which allows remote malicious users to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sixapart movable type 4.21
sixapart movable type 4.22
sixapart movable type 4.23
sixapart movable type 4.24
sixapart movable type 4.35
sixapart movable type 4.36
sixapart movable type 4.361
sixapart movable type 4.37
sixapart movable type 4.38
sixapart movable type 4.25
sixapart movable type 4.261
sixapart movable type 4.32
sixapart movable type 4.34
sixapart movable type 4.28
sixapart movable type 4.29
sixapart movable type 4.291
sixapart movable type 4.292
sixapart movable type 4.26
sixapart movable type 4.27
sixapart movable type 4.31
sixapart movable type 4.33

An input sanitation problem has been found in upgrade functions of movabletype-opensource, a web-based publishing platform Using carefully crafted requests to the mt-upgradecgi file, it would be possible to inject OS command and SQL queries For the stable distribution (squeeze), this problem has been fixed in version 438+dfsg-0+squeeze3 For t ...

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # web site for more information on licensing and terms of use # metasploitcom/ ## require 'msf/core' class Metasploit4 < Msf::Exploit::Remote include Exploit::Remote::HttpClient def ini ...

This Metasploit module can be used to execute a payload on MoveableType (MT) that exposes a CGI script, mt-upgradecgi (usually at /mt/mt-upgradecgi), that is used during installation and updating of the platform This allows for code injection ...

CWE-287 http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt http://www.movabletype.org/2013/01/movable_type_438_patch.html http://openwall.com/lists/oss-security/2013/01/22/3 http://www.sec-1.com/blog/?p=402 https://nvd.nist.gov https://www.debian.org/security/./dsa-2611 https://www.exploit-db.com/exploits/24321/

CVE-2013-0209

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect