Wordpress Multiple Cross-Site Scripting and SQL Injection Vulnerabilities
BID:12066
Info
Wordpress Multiple Cross-Site Scripting and SQL Injection Vulnerabilities
| Bugtraq ID: | 12066 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 21 2004 12:00AM |
| Updated: | Dec 21 2004 12:00AM |
| Credit: | These issues were reported by Thomas Waldegger <[email protected]>. |
| Vulnerable: |
WordPress WordPress 1.2.2 WordPress WordPress 1.2.1 |
| Not Vulnerable: |
WordPress WordPress 1.5.1 |
Discussion
Wordpress Multiple Cross-Site Scripting and SQL Injection Vulnerabilities
Wordpress is reported prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues arise due to insufficient sanitization of user-supplied data.
These issues were previously reported in Wordpress Multiple Cross-Site Scripting, HTML Injection, And SQL Injection Vulnerabilities (BID 11984). Subsequent to the release of BID 11984, the vendor released Wordpress 1.2.2 to address the issues.
It is reported that Wordpress 1.2.2 does not address all the issues specified in that BID and it is still vulnerable to some cross-site scripting and SQL injection issues.
Wordpress is reported prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues arise due to insufficient sanitization of user-supplied data.
These issues were previously reported in Wordpress Multiple Cross-Site Scripting, HTML Injection, And SQL Injection Vulnerabilities (BID 11984). Subsequent to the release of BID 11984, the vendor released Wordpress 1.2.2 to address the issues.
It is reported that Wordpress 1.2.2 does not address all the issues specified in that BID and it is still vulnerable to some cross-site scripting and SQL injection issues.
Exploit / POC
Wordpress Multiple Cross-Site Scripting and SQL Injection Vulnerabilities
An exploit is not required.
The following proof of concept examples are available:
Cross-site Scripting:
/wp-login.php?action=login&redirect_to=[XSS]
/wp-admin/templates.php?file=[XSS]
/wp-admin/post.php?content=[XSS]
SQL Injection:
/index.php?m=bla
/wp-admin/edit.php?m=bla
An exploit is not required.
The following proof of concept examples are available:
Cross-site Scripting:
/wp-login.php?action=login&redirect_to=[XSS]
/wp-admin/templates.php?file=[XSS]
/wp-admin/post.php?content=[XSS]
SQL Injection:
/index.php?m=bla
/wp-admin/edit.php?m=bla
Solution / Fix
Wordpress Multiple Cross-Site Scripting and SQL Injection Vulnerabilities
Solution:
New information suggests the vendor has addressed these issues in WordPress version 1.5.1.
WordPress WordPress 1.2.1
WordPress WordPress 1.2.2
Solution:
New information suggests the vendor has addressed these issues in WordPress version 1.5.1.
WordPress WordPress 1.2.1
-
WordPress WordPress Latest Release Download
http://wordpress.org/latest.tar.gz
WordPress WordPress 1.2.2
-
WordPress WordPress Latest Release Download
http://wordpress.org/latest.tar.gz
References
Wordpress Multiple Cross-Site Scripting and SQL Injection Vulnerabilities
References:
References:
- WordPress 1.5.1 Development (WordPress)
- WordPress Homepage (WordPress)
- Re: Wordpress 1.2.2 is still vulnerable (Thomas Waldegger