WordPress CVEs

Description

SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the s parameter, when DB_CHARSET is set to (1) Big5, (2) GBK, or possibly other character set encodings that support a "\" in a multibyte character.

Affected WordPress components

• WordPress core
  Confirmed match
  Version 2.0; Version 2.0.1; Version 2.0.2; Version 2.0.3; Version 2.0.4; Version 2.0.5; Version 2.0.6; Version 2.0.7; Version 2.0.10; Version 2.0.10_rc1; Version 2.0.10_rc2; Version 2.1.1; Version 2.1.2; Version 2.1.3; Version 2.1.3_rc1; Version 2.1.3_rc2; Version 2.2; Version 2.2.1; Version 2.2.2; Version 2.2.3; Version 2.2_revision5002; Version 2.2_revision5003; Version 2.3; Version 2.3.1

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Version 2.0
• wordpress wordpress — Version 2.0.1
• wordpress wordpress — Version 2.0.2
• wordpress wordpress — Version 2.0.3
• wordpress wordpress — Version 2.0.4
• wordpress wordpress — Version 2.0.5
• wordpress wordpress — Version 2.0.6
• wordpress wordpress — Version 2.0.7
• wordpress wordpress — Version 2.0.10
• wordpress wordpress — Version 2.0.10_rc1
• wordpress wordpress — Version 2.0.10_rc2
• wordpress wordpress — Version 2.1.1
• wordpress wordpress — Version 2.1.2
• wordpress wordpress — Version 2.1.3
• wordpress wordpress — Version 2.1.3_rc1
• wordpress wordpress — Version 2.1.3_rc2
• wordpress wordpress — Version 2.2
• wordpress wordpress — Version 2.2.1
• wordpress wordpress — Version 2.2.2
• wordpress wordpress — Version 2.2.3
• wordpress wordpress — Version 2.2_revision5002
• wordpress wordpress — Version 2.2_revision5003
• wordpress wordpress — Version 2.3
• wordpress wordpress — Version 2.3.1

References

• lists.grok.org.uk http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/058999.html
• secunia.com http://secunia.com/advisories/28005 Vendor Advisory
• secunia.com http://secunia.com/advisories/28310
• securityreason.com http://securityreason.com/securityalert/3433
• www.abelcheung.org http://www.abelcheung.org/advisory/20071210-wordpress-charset.txt Exploit
• www.securityfocus.com http://www.securityfocus.com/archive/1/484828/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/bid/26795 Exploit
• www.securitytracker.com http://www.securitytracker.com/id?1019071
• www.vupen.com http://www.vupen.com/english/advisories/2007/4172
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/38959
• www.redhat.com https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00079.html
• www.redhat.com https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00098.html
• nvd.nist.gov Official NVD record