Bludit 3.16.2 Exploit: When Your Website Title Takes a Detour!
Andrey Stoykov has uncovered a new exploit for Bludit v3.16.2, involving directory traversal via the site title. Just when you thought your admin login was safe, it turns out that setting your site title to “../../../malicious” might lead to more than just questionable aesthetics.
Hot Take:
In a world where web security vulnerabilities pop up like mushrooms after rain, Bludit version 3.16.2 has become the latest victim of a directory traversal escapade. It seems like even the “site title” setting has taken a rebellious turn, deciding it wants to explore the deeper, darker directories of your server. Who knew a title could be so adventurous?
Key Points:
- Bludit version 3.16.2 is vulnerable to directory traversal attacks via the “Site Title” setting.
- The exploit allows attackers to upload a malicious SVG file to the server.
- The vulnerability was tested on a Debian 12 environment.
- The exploit was shared by Andrey Stoykov through the Full Disclosure mailing list.
- The attack involves manipulating HTTP requests to traverse directories and upload harmful files.
Already a member? Log in here