CVE-2007-4047 geoBlog (aka BitDamaged) 1 does not require authentication for (1) deletecomment.php, (2) deleteblog.php, and (3) listcomment.php in admin/, which allows remote attackers to delete arbitrary comments,...
MediumCVSS 6.4
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
geoBlog (aka BitDamaged) 1 does not require authentication for (1) deletecomment.php, (2) deleteblog.php, and (3) listcomment.php in admin/, which allows remote attackers to delete arbitrary comments, delete arbitrary blogs, and have other unspecified impact via a request with a valid id parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| geoblog | = 1 | No fix listed |
References
- 42485 vdb-entry
- 42486 vdb-entry
- 42487 vdb-entry
- 2934 third-party-advisory
- 20070719 Geoblog v1 administrator bypass mailing-list
- 24966 exploit vdb-entry
- geoblog-listcomments-security-bypass(35494) vdb-entry