CVE-2007-4154: SQL Injection

Published Aug 3, 2007

Updated

SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the pageoptions parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.

Affected Software

1 affected component

WordPress=2.2.1

Event History

Aug 3, 2007

CVE Published

08:17 PM

Aug 4, 2007

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4154?

CVE-2007-4154 is considered a critical vulnerability due to its potential for remote authenticated administrators to execute arbitrary SQL commands.

How do I fix CVE-2007-4154?

To fix CVE-2007-4154, you should upgrade your WordPress installation to version 2.2.2 or later which addresses this vulnerability.

Who is affected by CVE-2007-4154?

CVE-2007-4154 affects WordPress version 2.2.1, specifically those installations allowing remote authenticated administrators access.

What kind of attacks can be executed using CVE-2007-4154?

CVE-2007-4154 allows attackers to perform SQL injection attacks, potentially compromising the database and modifying data.

Is there a specific workaround for CVE-2007-4154?

There are no known effective workarounds for CVE-2007-4154, so upgrading to a secure version is strongly recommended.