Movable Type is prone to multiple SQL-injection and command-injection vulnerabilities because the application fails to properly sanitize user- supplied input. Exploiting these issues could allow an attacker to execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Versions prior to Movable Type 4.38 are vulnerable.

Updates are available. Please see the references for more details.

• http://www.securityfocus.com/bid/57490
• http://www.sixapart.com/movabletype/

---

Updated on 2015-03-25