CVE-2007-0107 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2007-0107
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2007-0107

Description: WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/31297 SREASON http://securityreason.com/securityalert/2112 SAID Secunia Advisory: SA23741 Secunia Advisory: SA23595 OSVDB 31579 OPENPKG http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html MISC http://www.hardened-php.net/advisory_022007.141.html GENTOO http://security.gentoo.org/glsa/glsa-200701-10.xml CONFIRM http://wordpress.org/development/2007/01/wordpress-206/ BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/456049/100/0/threaded BID 21907

Return to the previous page.