Description
SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | movabletype-opensource | 5.1.4+dfsg-4+deb7u4 | DLA-532-1 |
Advisories 1
- DLA-532-1 movabletype-opensource - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20160622 Re: CVE request: SQL injection in MovableType xml-rpc interface mailing-list
- 1036160 vdb-entry
- [oss-security] 20160622 CVE request: SQL injection in MovableType xml-rpc interface mailing-list
- https://movabletype.org/news/2016/06/movable_type_626_and_613_released.html
- [oss-security] 20160622 Re: CVE request: SQL injection in MovableType xml-rpc interface mailing-list