CVE-2007-0107 WordPress Core <= 2.0.5 - SQL Injection
MediumCVSS 6.8
EPSS 11.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress | <= 2.0.5 | No fix listed |
| debian/wordpress(Debian:12) | < 2.0.6-1 | 2.0.6-1 |
| debian/wordpress(Debian:13) | < 2.0.6-1 | 2.0.6-1 |
| debian/wordpress(Debian:14) | < 2.0.6-1 | 2.0.6-1 |
| WordPress(WordPress) | < 2.0.6 | 2.0.6 |
References
- 31579 vdb-entry
- 23595 patch third-party-advisory vendor-advisory
- 23741 third-party-advisory
- GLSA-200701-10 vendor-advisory
- 2112 third-party-advisory
- wordpress.org patch
- www.hardened-php.net patch vendor-advisory
- OpenPKG-SA-2007.005 patch vendor-advisory
- 20070105 Advisory 02/2007: WordPress Trackback Charset Decoding SQL Injection Vulnerability mailing-list
- 21907 exploit patch vdb-entry
- ADV-2007-0061 vdb-entry
- wordpress-mbstring-security-bypass(31297) vdb-entry
- Debian Security Tracker CVE-2007-0107 vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org
- bugs.debian.org issue-tracking