CVEvulnerability
CVE-2013-0209
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-01-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
Affected configurations
• sixapart movable type 4.21
• sixapart movable type 4.22
• sixapart movable type 4.23
• sixapart movable type 4.24
• sixapart movable type 4.25
• sixapart movable type 4.26
• sixapart movable type 4.27
• sixapart movable type 4.28
• sixapart movable type 4.29
• sixapart movable type 4.31
• sixapart movable type 4.32
• sixapart movable type 4.33
• sixapart movable type 4.34
• sixapart movable type 4.35
• sixapart movable type 4.36
• sixapart movable type 4.37
• sixapart movable type 4.38
• sixapart movable type 4.261
• sixapart movable type 4.291
• sixapart movable type 4.292
• sixapart movable type 4.361
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://openwall.com/lists/oss-security/2013/01/22/3 openwall.com
- http://www.movabletype.org/2013/01/movable_type_438_patch.html Patch, Vendor Advisory
- http://www.sec-1.com/blog/?p=402 Exploit
- http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt Exploit
- http://openwall.com/lists/oss-security/2013/01/22/3 openwall.com
- http://www.movabletype.org/2013/01/movable_type_438_patch.html Patch, Vendor Advisory
- http://www.sec-1.com/blog/?p=402 Exploit
- http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt Exploit