CVE-2013-0209

Published: Jan 23, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.

Affected (33)

Products: Sixapart: Movable Type

Sixapart

1 product

Movable Type

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Sixapart Movable Type	Version 4.21
Sixapart Movable Type	Version 4.22
Sixapart Movable Type	Version 4.23
Sixapart Movable Type	Version 4.24
Sixapart Movable Type	Version 4.25
Sixapart Movable Type	Version 4.261
Sixapart Movable Type	Version 4.26
Sixapart Movable Type	Version 4.27
Sixapart Movable Type	Version 4.28
Sixapart Movable Type	Version 4.28
Sixapart Movable Type	Version 4.28
Sixapart Movable Type	Version 4.291
Sixapart Movable Type	Version 4.291
Sixapart Movable Type	Version 4.291
Sixapart Movable Type	Version 4.292
Sixapart Movable Type	Version 4.292
Sixapart Movable Type	Version 4.292
Sixapart Movable Type	Version 4.29
Sixapart Movable Type	Version 4.29
Sixapart Movable Type	Version 4.29
Sixapart Movable Type	Version 4.31
Sixapart Movable Type	Version 4.32
Sixapart Movable Type	Version 4.33
Sixapart Movable Type	Version 4.34
Sixapart Movable Type	Version 4.35
Sixapart Movable Type	Version 4.361
Sixapart Movable Type	Version 4.36
Sixapart Movable Type	Version 4.37
Sixapart Movable Type	Version 4.38