CVE-2013-0209

Related Files

Movable Type 4.2x / 4.3x Web Upgrade Remote Code Execution

Posted Jan 25, 2013

Authored by Gary O'Leary-Steele, Nick Blundell, Kacper Nowak | Site metasploit.com

This Metasploit module can be used to execute a payload on MoveableType (MT) that exposes a CGI script, mt-upgrade.cgi (usually at /mt/mt-upgrade.cgi), that is used during installation and updating of the platform. This allows for code injection.

tags | exploit, cgi

advisories | CVE-2012-6315, CVE-2013-0209

SHA-256 | 9f1569dcdb5b14c9f7ccc437f947a2040582d389fc39d6d3e38a34b0a7f83d25

Download | Favorite | View

Debian Security Advisory 2611-1

Posted Jan 23, 2013

Authored by Debian | Site debian.org

Debian Linux Security Advisory 2611-1 - An input sanitation problem has been found in upgrade functions of movabletype-opensource, a web-based publishing platform. Using carefully crafted requests to the mt-upgrade.cgi file, it would be possible to inject OS command and SQL queries.

tags | advisory, web, cgi

systems | linux, debian

advisories | CVE-2013-0209

SHA-256 | 89d68f6be8ffae23f363d55090a96d9684ff07754963ce7062f93a265b75541c

Download | Favorite | View