FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2007-4894

This CVE name corresponds to:

Entered	Topic
2007-09-21	wordpress -- remote sql injection vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2007-4894 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2007-4894
Phase	Assigned(20070914)

Description

Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the post_type parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters related to "early database escaping" and missing validation of "query string like parameters."

References

Source	Reference
MISC	http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html
MISC	https://bugzilla.redhat.com/show_bug.cgi?id=285831
CONFIRM	http://trac.wordpress.org/ticket/4770
CONFIRM	http://wordpress.org/development/2007/09/wordpress-223/
FEDORA	FEDORA-2007-2143
VUPEN	ADV-2007-3132
SECUNIA	26771
SECUNIA	26796
XF	wordpress-wordpressmu-pingback-sql-injection(36578)