CVE-2007-0107: SQL Injection
Published Jan 9, 2007
·Updated
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.
Affected Software
1 affected component
WordPress<=2.0.5
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Jan 9, 2007
CVE Published
12:28 AM
Data Sourced
via NVD·12:28 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-0107?
CVE-2007-0107 has a medium severity rating due to its potential for allowing SQL injection attacks.
2
How do I fix CVE-2007-0107?
To fix CVE-2007-0107, upgrade WordPress to version 2.0.6 or later.
3
What are the affected versions for CVE-2007-0107?
CVE-2007-0107 affects WordPress versions prior to 2.0.6.
4
What type of attack does CVE-2007-0107 enable?
CVE-2007-0107 enables remote attackers to execute arbitrary SQL commands through multibyte charsets.
5
Which PHP feature is exploited in CVE-2007-0107?
CVE-2007-0107 exploits the mbstring feature of PHP when it is enabled.