CVE-2007-0107
MEDIUM
6.8
CVSS 2.0
Description
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.
Affected WordPress components
-
WordPress coreUp to and including 2.0.5
A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.
Affected products and versions
- n/a n/a — Versions not specified
- wordpress wordpress — Up to and including 2.0.5
References
- osvdb.org http://osvdb.org/31579
- secunia.com http://secunia.com/advisories/23595 Patch, Vendor Advisory
- secunia.com http://secunia.com/advisories/23741
- security.gentoo.org http://security.gentoo.org/glsa/glsa-200701-10.xml
- securityreason.com http://securityreason.com/securityalert/2112
- wordpress.org http://wordpress.org/development/2007/01/wordpress-206/ Patch
- www.hardened-php.net http://www.hardened-php.net/advisory_022007.141.html Patch, Vendor Advisory
- www.openpkg.com http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html Patch, Vendor Advisory
- www.securityfocus.com http://www.securityfocus.com/archive/1/456049/100/0/threaded
- www.securityfocus.com http://www.securityfocus.com/bid/21907 Exploit, Patch
- www.vupen.com http://www.vupen.com/english/advisories/2007/0061
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/31297
- nvd.nist.gov Official NVD record