SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $cat_ID variable, as demonstrated using the cat parameter to index.php.

A Gentoo Linux Security Advisory reports :

Due to a lack of input validation, WordPress is vulnerable to SQL injection and XSS attacks.

An attacker could use the SQL injection vulnerabilities to gain information from the database. Furthermore the cross-site scripting issues give an attacker the ability to inject and execute malicious script code or to steal cookie-based authentication credentials, potentially compromising the victim's browser.

The remote host is affected by the vulnerability described in GLSA-200506-04 (Wordpress: Multiple vulnerabilities)

    Due to a lack of input validation, WordPress is vulnerable to SQL     injection and XSS attacks.
  Impact :

    An attacker could use the SQL injection vulnerabilities to gain     information from the database. Furthermore the cross-site scripting     issues give an attacker the ability to inject and execute malicious     script code or to steal cookie-based authentication credentials,     potentially compromising the victim's browser.
  Workaround :

    There is no known workaround at this time.

The version of WordPress installed on the remote host fails to properly sanitize user-supplied input to the 'cat_ID' variable in the 'template-functions-category.php' script. This failure may allow an attacker to influence database queries resulting in the disclosure of sensitive information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Versions of WordPress prior to 1.5.1.2 are vulnerable to various flaws that may allow an attacker to perform a SQL injection attack against the remote host.  Successful exploitation would allow an attacker to read/write confidential data as well as potentially execute arbitrary code on the remote database.  In addition, the remote host is vulnerable to multiple cross-site scripting (XSS) flaws.

ID	Name	Product	Family	Severity
19058	FreeBSD : wordpress -- multiple vulnerabilities (a4955b32-ed84-11d9-8310-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
18427	GLSA-200506-04 : Wordpress: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
18420	WordPress 'template-functions-category.php' 'cat_ID' Parameter SQL Injection	Nessus	CGI abuses	high
2918	WordPress < 1.5.1.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2005-1810

critical

Tenable Plugins

high

high

high

high