chaitak-gorai Blogbook GET Parameter user.php sql injection

CVE Details

Basic Information

Title	chaitak-gorai Blogbook GET Parameter user.php sql injection
Type	cve
Published	2025-06-01T08:31:05.205Z
Last Seen

Product Information

Vendor	chaitak-gorai
Product	Blogbook
Version	92f5cf90f8a7e6566b576fe0952e14e1c6736513

CVSS Information

Base Score	6.9 (MEDIUM)
Attack Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Confidentiality Impact
Integrity Impact
Availability Impact

AI Analysis

AI Description	A critical SQL injection vulnerability exists in chaitak-gorai Blogbook, affecting versions up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. The vulnerability is in the GET parameter handler of the /user.php file, specifically in the u_id argument, allowing remote attackers to execute arbitrary SQL commands. The exploit is publicly available, and the vendor has not responded to the disclosure.
AI Severity	High
Vendor	chaitak-gorai
Product	Blogbook
Affected Version	92f5cf90f8a7e6566b576fe0952e14e1c6736513

Additional Information

CVE List
CWE List	CWE-89, CWE-74
Bulletin Family
Source Data	chaitak-gorai Blogbook 92f5cf90f8a7e6566b576fe0952e14e1c6736513

Source Information

Source Data	chaitak-gorai Blogbook 92f5cf90f8a7e6566b576fe0952e14e1c6736513
Source Link

Description

A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been classified as critical. Affected is an unknown function of the file /user.php of the component GET Parameter Handler. The manipulation of the argument u_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Score Summary

Base Score: 6.9 (MEDIUM)

View Full CVE Details