CVE-2013-0209: SQL Injection
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the coredropmetafortable function, leading to execution of arbitrary Perl code.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0209?
CVE-2013-0209 is considered a high severity vulnerability due to its potential for remote SQL injection and eval injection attacks.
How do I fix CVE-2013-0209?
To fix CVE-2013-0209, upgrade Movable Type to version 4.39 or later.
What software versions are affected by CVE-2013-0209?
CVE-2013-0209 affects Movable Type versions from 4.21 through 4.38.
Can CVE-2013-0209 allow remote access?
Yes, CVE-2013-0209 can allow remote attackers to execute arbitrary commands through SQL or eval injection.
Is authentication required to exploit CVE-2013-0209?
No, CVE-2013-0209 does not require authentication for requests, making it easier for attackers to exploit.