Read the docs
TI-2013-00143 Aliases CVE-2013-0209GHSA-qhr8-p6mw-gmf5

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not…

Priority MEDIUM 62CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.

Why it matters now

EPSS 0.45201 98th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 33

CPEVersionsRoleVendor
cpe:2.3:a:sixapart:movable_type:4.21:*:*:*:*:*:*:*4.21VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.22:*:*:*:*:*:*:*4.22VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.23:*:*:*:*:*:*:*4.23VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.24:*:*:*:*:*:*:*4.24VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.25:*:*:*:*:*:*:*4.25VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.26:*:*:*:*:*:*:*4.26VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.27:*:*:*:*:*:*:*4.27VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.28:*:*:*:*:*:*:*4.28VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.28:*:enterprise:*:*:*:*:*4.28VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.28:*:open_source:*:*:*:*:*4.28VulnerableSixapart
  • cpe:2.3:a:sixapart:movable_type:4.21:*:*:*:*:*:*:* Versions 4.21 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.22:*:*:*:*:*:*:* Versions 4.22 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.24:*:*:*:*:*:*:* Versions 4.24 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.25:*:*:*:*:*:*:* Versions 4.25 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.26:*:*:*:*:*:*:* Versions 4.26 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.27:*:*:*:*:*:*:* Versions 4.27 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.28:*:*:*:*:*:*:* Versions 4.28 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.28:*:enterprise:*:*:*:*:* Versions 4.28 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.28:*:open_source:*:*:*:*:* Versions 4.28 Vulnerable ·Sixapart
Show 23 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sixapart:movable_type:4.29:*:*:*:*:*:*:*4.29VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.29:*:enterprise:*:*:*:*:*4.29VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.29:*:open_source:*:*:*:*:*4.29VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.31:*:*:*:*:*:*:*4.31VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.32:*:*:*:*:*:*:*4.32VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.33:*:*:*:*:*:*:*4.33VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.34:*:*:*:*:*:*:*4.34VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.35:*:*:*:*:*:*:*4.35VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.36:*:*:*:*:*:*:*4.36VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.37:*:*:*:*:*:*:*4.37VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.38:*:*:*:*:*:*:*4.38VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.261:*:*:*:*:*:*:*4.261VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.291:*:*:*:*:*:*:*4.291VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.291:*:enterprise:*:*:*:*:*4.291VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.291:*:open_source:*:*:*:*:*4.291VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.292:*:*:*:*:*:*:*4.292VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.292:*:enterprise:*:*:*:*:*4.292VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.292:*:open_source:*:*:*:*:*4.292VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.361:*:*:*:*:*:*:*4.361VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.36:*:open_source:*:*:*:*:*4.36VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.37:*:open_source:*:*:*:*:*4.37VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.38:*:open_source:*:*:*:*:*4.38VulnerableSixapart
cpe:2.3:a:sixapart:movable_type:4.361:*:open_source:*:*:*:*:*4.361VulnerableSixapart
  • cpe:2.3:a:sixapart:movable_type:4.29:*:*:*:*:*:*:* Versions 4.29 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.29:*:enterprise:*:*:*:*:* Versions 4.29 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.29:*:open_source:*:*:*:*:* Versions 4.29 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.31:*:*:*:*:*:*:* Versions 4.31 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.32:*:*:*:*:*:*:* Versions 4.32 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.33:*:*:*:*:*:*:* Versions 4.33 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.34:*:*:*:*:*:*:* Versions 4.34 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.35:*:*:*:*:*:*:* Versions 4.35 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.36:*:*:*:*:*:*:* Versions 4.36 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.37:*:*:*:*:*:*:* Versions 4.37 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.38:*:*:*:*:*:*:* Versions 4.38 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.261:*:*:*:*:*:*:* Versions 4.261 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.291:*:*:*:*:*:*:* Versions 4.291 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.291:*:enterprise:*:*:*:*:* Versions 4.291 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.291:*:open_source:*:*:*:*:* Versions 4.291 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.292:*:*:*:*:*:*:* Versions 4.292 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.292:*:enterprise:*:*:*:*:* Versions 4.292 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.292:*:open_source:*:*:*:*:* Versions 4.292 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.361:*:*:*:*:*:*:* Versions 4.361 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.36:*:open_source:*:*:*:*:* Versions 4.36 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.37:*:open_source:*:*:*:*:* Versions 4.37 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.38:*:open_source:*:*:*:*:* Versions 4.38 Vulnerable ·Sixapart
  • cpe:2.3:a:sixapart:movable_type:4.361:*:open_source:*:*:*:*:* Versions 4.361 Vulnerable ·Sixapart

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-0209
  2. 2026-10-03 Alias added: GHSA-qhr8-p6mw-gmf5

References

Exploit 2

Patch 1

Other 1

  • TI-2021-04052 OS command injection in Six Apart Ltd. Movable Type CVSS 3.1CRITICAL 9.8
  • TI-2015-01424 Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x… CVSS 2.0HIGH 7.5
  • TI-2026-20843 Code injection in Six Apart Ltd. Movable Type CVSS 4.0CRITICAL 9.3
  • TI-2022-17791 Code injection in Six Apart Ltd. Movable Type XMLRPC API CVSS 3.1CRITICAL 9.8
  • TI-2009-00717 Unspecified vulnerability in Movable Type Pro and Community Solution 4.x before 4.24 has… CVSS 2.0HIGH 10.0
  • TI-2016-04984 SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x… CVSS 3.0CRITICAL 9.8
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences