|
WordPress Multiple Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA26771
|
|
|
Release Date:
|
2007-09-12
|
|
Last Update:
|
2008-05-14
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Security Bypass
Cross Site Scripting
Manipulation of data
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | WordPress 2.x
WordPress MU 1.x
|
| | CVE reference: | CVE-2007-4893 (Secunia mirror)
CVE-2007-4894 (Secunia mirror)
CVE-2008-2146 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Some vulnerabilities have been reported in WordPress, which can be exploited by malicious users to conduct script insertion attacks and bypass certain security restrictions, and by malicious people to conduct SQL injection attacks.
1) The "unfiltered_html" privilege feature can be bypassed by adding a field named "no_filter". This can be exploited by malicious users without the "unfiltered_html" privilege to e.g. post blog entries with arbitrary HTML and script code via specially crafted POST requests.
2) Input passed to certain parameters (e.g. the "post_type" parameter of the URL passed to the "pingback.extensions.getPingbacks()" XMLRPC method) is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
3) A vulnerability is caused due to improper access restriction. This can be exploited to bypass the authentication mechanism and e.g. switch themes or activate/deactivate plugins without valid administrator credentials, by passing malicious data in the "PATH_INFO" part of a URL.
Successful exploitation of this vulnerability requires valid user credentials.
The vulnerabilities are reported in Wordpress prior to 2.2.3 and Wordpress MU prior to 1.2.5a.
Solution:
Update to Wordpress version 2.2.3 or Wordpress MU version 1.2.5a.
Provided and/or discovered by:
1) xknown
2) Alexander Concha, buayacorp.com
3) xknown
Changelog:
2007-09-18: Added CVE reference.
2008-05-14: Added vulnerability #3. Added CVE reference.
Original Advisory:
1) http://trac.wordpress.org/ticket/4720
2) http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html
3) http://trac.wordpress.org/ticket/4748
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
30 Related Secunia Security Advisories, displaying 10
|
|
|
1. WordPress PHP Code Execution and Cross-Site Scripting
|
|
2. WordPress "cat" Directory Traversal Vulnerability
|
|
3. WordPress XML-RPC Post Edit Vulnerability
|
|
4. WordPress MU File Upload and Security Bypass
|
|
5. WordPress Multiple Information Disclosure Vulnerabilities
|
|
6. WordPress GBK/Big5 Character Set "s" SQL Injection
|
|
7. WordPress Cookies Security Bypass Weakness
|
|
8. WordPress "posts_columns" Cross-Site Scripting
|
|
9. WordPress "style" Cross-Site Scripting
|
|
10. WordPress Custom Field PHP Script Upload
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
