Detections
Analytics
WordPress Trackback Charset Decoding SQL Injection
medium Nessus Plugin ID 24011
Language:
Synopsis
The remote web server contains a PHP application that is affected by a SQL injection attack.Description
The version of WordPress on the remote host supports trackbacks in alternate character sets and decodes them after escaping SQL parameters. By specifying an alternate character set and encoding input with that character set while submitting a trackback, an unauthenticated, remote attacker can bypass the application's parameter sanitation code and manipulate database queries.Note that exploitation of this issue is only possible when PHP's mbstring extension is installed, which is the case with the remote host.
Solution
Upgrade to WordPress version 2.0.6 or later.See Also
http://www.hardened-php.net/advisory_022007.141.html
Plugin Details
Severity: Medium
ID: 24011
File Name: wordpress_trackback_charset_sql_injection.nasl
Version: 1.24
Type: remote
Family: CGI abuses
Published: 1/12/2007
Updated: 6/6/2024
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:wordpress:wordpress
Required KB Items: installed_sw/WordPress, www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Patch Publication Date: 1/5/2007
Vulnerability Publication Date: 1/5/2007
Reference Information
CVE: CVE-2007-0107