UpHeron
All vulnerabilities

Servers and applications

CVE-2013-0209

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.

Severity
High 7.5
Published
23 Jan 2013
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
45% in the next 30 daysHigher than 98% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Improper authentication (CWE-287)
Attack
Over the network · No login needed
Attacker can
Read some data · Change some data · Slow it down
CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
Sources
NVD

Affected software

SoftwareAffected versions
Movable TypeServers and applications · cpe:a:sixapart:movable_type
  • Version 4.361
  • Version 4.292
  • Version 4.291
  • Version 4.261
All 21 release lines
  • Version 4.21
  • Version 4.22
  • Version 4.23
  • Version 4.24
  • Version 4.25
  • Version 4.26
  • Version 4.27
  • Version 4.28
  • Version 4.29
  • Version 4.31
  • Version 4.32
  • Version 4.33
  • Version 4.34
  • Version 4.35
  • Version 4.36
  • Version 4.37
  • Version 4.38
  • Version 4.261
  • Version 4.291
  • Version 4.292
  • Version 4.361

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2013-0209
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2013-0209