PT-2007-1592 · WordPress+1 · Wordpress+1

Publicado 2007-01-09 · Atualizado 2018-10-16 · CVE-2007-0107

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 2.0.6

Description The issue allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, such as UTF-7, when mbstring is enabled for PHP. This occurs because WordPress decodes alternate character sets after escaping the SQL query.

Recommendations For WordPress versions prior to 2.0.6, update to version 2.0.6 or later to resolve the issue. As a temporary workaround, consider disabling the mbstring extension for PHP until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2007-0107

Produtos afetados

Php

Wordpress

Referências · 18

• 🔥 https://exploit-db.com/exploits/3095 · Exploit
• 🔥 http://securityfocus.com/bid/21907 · Exploit
• http://openpkg.com/security/advisories/OpenPKG-SA-2007.005.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2007-0107 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-0107 · Nota de Segurança
• http://securityfocus.com/archive/1/456049/100/0/threaded · Nota
• http://vupen.com/english/advisories/2007/0061 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31297 · Nota
• http://security.gentoo.org/glsa/glsa-200701-10.xml · Aviso do Fabricante
• http://wordpress.org/development/2007/01/wordpress-206 · Correção
• http://securityreason.com/securityalert/2112 · Nota
• http://secunia.com/advisories/23595 · Aviso do Fabricante
• http://secunia.com/advisories/23741 · Nota
• http://hardened-php.net/advisory_022007.141.html · Aviso do Fabricante
• http://osvdb.org/31579 · Nota