Description

WordPress is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. Successful exploits may result in unauthorized access. WordPress versions 2.0.6 and prior are vulnerable.

Remediation

Update to WordPress version 2.0.7 or latest

References

http://www.securityfocus.com/bid/21983/exploit

http://www.exploit-db.com/exploits/3109/

https://wordpress.org/news/2007/01/wordpress-207/

Related Vulnerabilities

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-4938)

CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-20716)

Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-1476)

PostgreSQL CVE-2021-32029 Vulnerability (CVE-2021-32029)

WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar Cross-Site Scripting (3.0.1)

Severity

High

Classification

CVE-2007-0233 CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection