WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.

The remote host is affected by the vulnerability described in GLSA-200701-10 (WordPress: Multiple vulnerabilities)

    When decoding trackbacks with alternate character sets, WordPress does     not correctly sanitize the entries before further modifying a SQL     query. WordPress also displays different error messages in wp-login.php     based upon whether or not a user exists. David Kierznowski has     discovered that WordPress fails to properly sanitize recent file     information in /wp-admin/templates.php before sending that information     to a browser.
  Impact :

    An attacker could inject arbitrary SQL into WordPress database queries.
    An attacker could also determine if a WordPress user existed by trying     to login as that user, better facilitating brute-force attacks. Lastly,     an attacker authenticated to view the administrative section of a     WordPress instance could try to edit a file with a malicious filename;
    this may cause arbitrary HTML or JavaScript to be executed in users'     browsers viewing /wp-admin/templates.php.
  Workaround :

    There is no known workaround at this time.

The version of WordPress on the remote host supports trackbacks in alternate character sets and decodes them after escaping SQL parameters. By specifying an alternate character set and encoding input with that character set while submitting a trackback, an unauthenticated, remote attacker can bypass the application's parameter sanitation code and manipulate database queries.

Note that exploitation of this issue is only possible when PHP's mbstring extension is installed, which is the case with the remote host.

The remote host is running WordPress, a web blog manager written in PHP. The remote version of this software is reported to be vulnerable to a flaw where a remote attacker can inject malicious script code into the 'file' parameter of the 'template.php' script.  Successful exploitation would result in script code being executed in the browsers of other WordPress clients.  In addition, the application is reported to be vulnerable to a SQL injection attack. An attacker exploiting this attack vector would only need to send malformed requests to the WordPress application. Successful exploitation would result in the attacker executing arbitrary SQL statements on the database server utilized by WordPress.

ID	Name	Product	Family	Severity
24208	GLSA-200701-10 : WordPress: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
24011	WordPress Trackback Charset Decoding SQL Injection	Nessus	CGI abuses	medium
3873	WordPress < 2.0.6 HTML Parameter Injection	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2007-0107

critical

Tenable Plugins

medium

medium

medium