Geoblog v1 administrator bypass

Credit: joseph
Risk: High
Local: No
Remote: Yes

CVSS Base Score: 6.4/10
Impact Subscore: 4.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: Partial

Geoblog v1. A vulnerability exists in geoblog version 1 (latest) that allows users to delete other peoples comments without administration credentials. It works on blogs too. Users can delete blogs without user credentials. The reason why is because the listcomments.php and deletecomments.php files fail to include checks for authenticity. The following proof of concept is as follows: The ID being the blog ID obtained from the index. Using this we can go here... And delete comments without any admin sosay. And the blog deletion. The fix presently would be to add checks for authenticity like the other files. if($_SESSION['login'] != "user_valid_and_logged_in") { header("Location: ../index.php"); }

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024,


Back to Top