PT-2012-1989 · WordPress+1 · Wordpress+1

Published 2012-01-30 · Updated 2024-08-07 · CVE-2011-4899

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions 3.3.1 and earlier

Description The installation component in WordPress does not ensure that the specified MySQL database service is appropriate, allowing remote attackers to configure an arbitrary database via the dbhost and dbname parameters. This can lead to static code injection and cross-site scripting (XSS) attacks via an HTTP request or a MySQL query. The vendor disputes the significance of this issue, but remote code execution makes it important in many realistic environments.

Recommendations For WordPress versions 3.3.1 and earlier, as a temporary workaround, consider restricting access to the wp-admin/setup-config.php installation component to minimize the risk of exploitation. Avoid using the dbhost and dbname parameters in the affected installation component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2011-4899

Affected Products

Debian

Wordpress

References · 16

• 🔥 https://trustwave.com/spiderlabs/advisories/TWSL2012-002.txt · Exploit
• 🔥 https://exploit-db.com/exploits/18417 · Exploit
• 🔥 http://exploit-db.com/exploits/18417 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-01/0150.html · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4899 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4899 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-4899 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4899 · Security Note
• https://ubuntu.com/security/CVE-2011-4899 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2011-4899 · Security Note
• https://security-tracker.debian.org/tracker/source-package/wordpress · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4899 · Security Note
• https://t.me/cvenotify/89541 · Telegram Post
• https://packages.debian.org/src:wordpress · Note