FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2010-4257

This CVE name corresponds to:

Entered	Topic
2011-02-05	wordpress -- SQL injection vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2010-4257 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2010-4257
Phase	Assigned(20101116)

Description

SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.

References

Source	Reference
MISC	http://blog.sjinks.pro/wordpress/858-information-disclosure-via-sql-injection-attack/
MISC	http://www.xakep.ru/magazine/xa/124/052/1.asp
CONFIRM	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605603
CONFIRM	http://codex.wordpress.org/Version_3.0.2
CONFIRM	http://core.trac.wordpress.org/changeset/16625
CONFIRM	http://wordpress.org/news/2010/11/wordpress-3-0-2/
CONFIRM	https://bugzilla.redhat.com/show_bug.cgi?id=659265
DEBIAN	DSA-2138
FEDORA	FEDORA-2010-19290
FEDORA	FEDORA-2010-19296
FEDORA	FEDORA-2010-19329
FEDORA	FEDORA-2010-19330
BID	45131
SECUNIA	42431
SECUNIA	42753
SECUNIA	42844
SECUNIA	42871
VUPEN	ADV-2010-3337
VUPEN	ADV-2011-0042
VUPEN	ADV-2011-0057