CVE-2007-0107: SQL Injection
First published: Tue Jan 09 2007(Updated: )
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress | <=2.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.hardened-php.net/advisory_022007.141.html
- http://wordpress.org/development/2007/01/wordpress-206/
- http://www.securityfocus.com/bid/21907
- http://secunia.com/advisories/23595
- http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html
- http://security.gentoo.org/glsa/glsa-200701-10.xml
- http://secunia.com/advisories/23741
- http://securityreason.com/securityalert/2112
- http://osvdb.org/31579
- http://www.vupen.com/english/advisories/2007/0061
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31297
- http://www.securityfocus.com/archive/1/456049/100/0/threaded
- agent/references
- agent/type
- agent/softwarecombine
- agent/author
- agent/severity
- agent/remedy
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/wordpress
- canonical/wordpress
- version/wordpress/2.0.5