| Package | Affected versions | Patched versions |
|---|---|---|
| movable type | = 4.21= 4.22= 4.23= 4.24= 4.25= 4.26= 4.261= 4.27= 4.28= 4.29= 4.291= 4.292= 4.31= 4.32= 4.33= 4.34= 4.35= 4.36= 4.361= 4.37= 4.38 |
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free