Published: 21/03/2019 Updated: 18/06/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

An issue exists in BlogEngine.NET up to and including 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility, which is currently allowed. This results in remote code execution for an authenticated user.

Vulnerable Product	Search on Vulmon	Subscribe to Product
blogengine blogengine.net

# Exploit Title: BlogEngineNET <= 336 Directory Traversal RCE # Date: 02-11-2019 # Exploit Author: Dustin Cobb # Vendor Homepage: githubcom/rxtur/BlogEngineNET/ # Software Link: githubcom/rxtur/BlogEngineNET/releases/download/v3360/3360zip # Version: <= 336 # Tested on: Windows 2016 Standard / IIS 100 # CVE : CVE ...

BlogEngineNET version 336 suffers from code execution and directory traversal vulnerabilities ...

Pentest make easy The purspose of this site is to make the Penetration testing and Privilege escation make easy There are several exploits and various writeup avilable But when it is needed its very difficult to find out the exact exploit and the writeup In this site I am attempting to collect most of the common exploits that appear in CTF and other exinvornments SQL Inject

CWE-22 https://www.exploit-db.com/exploits/46353/https://github.com/rxtur/BlogEngine.NET/https://blogengine.io/http://packetstormsecurity.com/files/151628/BlogEngine.NET-3.3.6-Directory-Traversal-Remote-Code-Execution.html http://seclists.org/fulldisclosure/2019/Jun/26 https://nvd.nist.gov https://github.com/dayaramb/dayaramb.github.io https://www.exploit-db.com/exploits/46353

CVE-2019-6714

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect