FKIE_CVE-2013-0209

Vulnerability from fkie_nvd - Published: 2013-01-23 01:55 - Updated: 2026-06-16 23:48
Severity
Summary
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
References
secalert@redhat.comhttp://openwall.com/lists/oss-security/2013/01/22/3
secalert@redhat.comhttp://www.movabletype.org/2013/01/movable_type_438_patch.htmlPatch, Vendor Advisory
secalert@redhat.comhttp://www.sec-1.com/blog/?p=402Exploit
secalert@redhat.comhttp://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txtExploit
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2013/01/22/3
af854a3a-2127-422b-91ae-364da2661108http://www.movabletype.org/2013/01/movable_type_438_patch.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.sec-1.com/blog/?p=402Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txtExploit
Impacted products
Vendor Product Version
sixapart movable_type 4.21
sixapart movable_type 4.22
sixapart movable_type 4.23
sixapart movable_type 4.24
sixapart movable_type 4.25
sixapart movable_type 4.26
sixapart movable_type 4.27
sixapart movable_type 4.28
sixapart movable_type 4.28
sixapart movable_type 4.28
sixapart movable_type 4.29
sixapart movable_type 4.29
sixapart movable_type 4.29
sixapart movable_type 4.31
sixapart movable_type 4.32
sixapart movable_type 4.33
sixapart movable_type 4.34
sixapart movable_type 4.35
sixapart movable_type 4.36
sixapart movable_type 4.37
sixapart movable_type 4.38
sixapart movable_type 4.261
sixapart movable_type 4.291
sixapart movable_type 4.291
sixapart movable_type 4.291
sixapart movable_type 4.292
sixapart movable_type 4.292
sixapart movable_type 4.292
sixapart movable_type 4.361
sixapart movable_type 4.36
sixapart movable_type 4.37
sixapart movable_type 4.38
sixapart movable_type 4.361
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "7AD39A71-0B61-4319-BEE1-12CAD4B095A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "E36DD87F-F918-4BDD-98B7-41527470B838",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B49D8B0-39C9-480B-9471-1846CE5A2142",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "F909511A-D7B6-4033-AB99-87D6BC5741F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.25:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A200E33-641A-41B3-8EB3-E7380B686C8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.26:*:*:*:*:*:*:*",
              "matchCriteriaId": "52311931-CE3A-487B-B153-4066D07F63E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.27:*:*:*:*:*:*:*",
              "matchCriteriaId": "86ED3B93-8769-4A60-BAE4-C50483254905",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.28:*:*:*:*:*:*:*",
              "matchCriteriaId": "703EEB4B-4747-45D5-9335-6FD5CB238F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.28:*:enterprise:*:*:*:*:*",
              "matchCriteriaId": "4A2BA875-0C6E-4AD4-9271-CB31E2B2B072",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.28:*:open_source:*:*:*:*:*",
              "matchCriteriaId": "BAAD088A-29B4-44B4-BB90-6BEF55428902",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.29:*:*:*:*:*:*:*",
              "matchCriteriaId": "36E48EE7-3212-406E-80AB-26B0206E97E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.29:*:enterprise:*:*:*:*:*",
              "matchCriteriaId": "59DC45AB-BF7F-4817-A0FB-E3EBCA8CB761",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.29:*:open_source:*:*:*:*:*",
              "matchCriteriaId": "6DE4CBB7-14AE-45F4-9170-3C097844E8DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4E3F7E4-FD59-49B2-96B8-EF8AFEB1E01A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.32:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA5666EE-4383-417D-871F-480093A6A49D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.33:*:*:*:*:*:*:*",
              "matchCriteriaId": "F273F33D-A680-4FCE-A80A-38D9BC98A7FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.34:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C23010F-2AEF-4574-A857-7F41F082F707",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.35:*:*:*:*:*:*:*",
              "matchCriteriaId": "1ADC65FF-B4E8-4346-80DE-647BDC4A4D3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.36:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8E76C88-E486-4463-BA41-6A08ECC5E214",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.37:*:*:*:*:*:*:*",
              "matchCriteriaId": "93798CD5-1099-4B6A-9303-6EFD037F5B11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.38:*:*:*:*:*:*:*",
              "matchCriteriaId": "B053E3DC-BE9E-4AA5-90B6-362E4F4953C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.261:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4905997-E4CE-406D-BE0F-B5E2F87AA177",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.291:*:*:*:*:*:*:*",
              "matchCriteriaId": "45A49069-F509-4C30-BC9F-DB1FF7C39294",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.291:*:enterprise:*:*:*:*:*",
              "matchCriteriaId": "B516CE7A-7751-4CE0-8E16-097058A6657D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.291:*:open_source:*:*:*:*:*",
              "matchCriteriaId": "320C5974-DA38-443F-9BAF-C60E729D3148",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.292:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7330A56-5D69-495B-B0E9-A820B70573C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.292:*:enterprise:*:*:*:*:*",
              "matchCriteriaId": "563F69FA-34DD-4BF3-9B94-D41848E13915",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.292:*:open_source:*:*:*:*:*",
              "matchCriteriaId": "7020769D-803A-473A-8F1A-4984F870D6B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.361:*:*:*:*:*:*:*",
              "matchCriteriaId": "9951EF1D-0D13-4215-9066-C17B352E6C6F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.36:*:open_source:*:*:*:*:*",
              "matchCriteriaId": "CD6E7E17-E69C-43C7-A9E3-1A7339B8BF68",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.37:*:open_source:*:*:*:*:*",
              "matchCriteriaId": "691C9C90-E88D-4E6F-A1DD-413FC73B9EF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.38:*:open_source:*:*:*:*:*",
              "matchCriteriaId": "F7F06FE8-50EF-4838-B1C5-2D347AC4B4E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:4.361:*:open_source:*:*:*:*:*",
              "matchCriteriaId": "85FA0AB7-78D6-42DC-83E7-9630BD8EFCD0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code."
    },
    {
      "lang": "es",
      "value": "lib/MT/Upgrade.pm en mt-upgrade.cgi en Movable Type v4.2x y v4.3x hasta v4.38 no requiere autenticaci\u00f3n para las peticiones a las funciones de migraci\u00f3n de base de datos, lo que permite a atacantes remotos llevar a cabo  inyecciones eval y ataques de inyecci\u00f3n SQL a trav\u00e9s de par\u00e1metros especialmente elaborados, como se demuestra por un ataque de inyecci\u00f3n eval contra la funci\u00f3n core_drop_meta_for_table, dando lugar a la ejecuci\u00f3n de c\u00f3digo Perl."
    }
  ],
  "id": "CVE-2013-0209",
  "lastModified": "2026-06-16T23:48:58.330",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2013-01-23T01:55:01.150",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://openwall.com/lists/oss-security/2013/01/22/3"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.movabletype.org/2013/01/movable_type_438_patch.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.sec-1.com/blog/?p=402"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://openwall.com/lists/oss-security/2013/01/22/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.movabletype.org/2013/01/movable_type_438_patch.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.sec-1.com/blog/?p=402"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.