CVE-2013-0209
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require...
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
Exploit likelihood
What each source reports
NVD Score used
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
- Record
CVE-2013-0209- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
- Record
CVE-2013-0209- Updated
- 2026-11-02
EUVDEUVD-2013-0244 No score
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
- Record
EUVD-2013-0244- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qhr8-p6mw-gmf5 No score
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require...
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
- Record
GHSA-qhr8-p6mw-gmf5- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
movabletype-opensourceDebian:6.0 |
before 4.3.8+dfsg-0+squeeze3, plus listed versions 4.3.5+dfsg-24.3.5+dfsg-2+squeeze14.3.5+dfsg-2+squeeze24.3.5+dfsg-34.3.6+dfsg-14.3.6.1+dfsg-14.3.7+dfsg-14.3.8+dfsg-0+squeeze2 |
4.3.8+dfsg-0+squeeze3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Movable Type 4.2x/4.3x - Web Upgrade Remote Code Execution (Metasploit) | 2013-01-07 |
| Metasploit | Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution | 2013-01-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-0209 is a high vulnerability (CVSS 7.5) in Sixapart Movable Type, published January 22, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 45.2%, the 98th percentile. Fixed in movabletype-opensource 4.3.8+dfsg-0+squeeze3.