SecuritySpace - CVE-2013-0209

Vulnerability Search		Search 324607 CVE descriptions and 145615 test descriptions, access 10,000+ cross references.
	Tests CVE All

CVE ID: CVE-2013-0209

Description: lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database- migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.

Test IDs: 1.3.6.1.4.1.25623.1.0.702611 1.3.6.1.4.1.25623.1.0.103651

Cross References: Common Vulnerability Exposure (CVE) ID: CVE-2013-0209
http://www.sec-1.com/blog/?p=402
http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt
http://openwall.com/lists/oss-security/2013/01/22/3

CVE ID:	CVE-2013-0209
Description:	lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database- migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
Test IDs:	1.3.6.1.4.1.25623.1.0.702611 1.3.6.1.4.1.25623.1.0.103651
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2013-0209 http://www.sec-1.com/blog/?p=402 http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt http://openwall.com/lists/oss-security/2013/01/22/3