Wordpress WP-Trackback.PHP SQL Injection Vulnerability

Bugtraq ID:	13655
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 17 2005 12:00AM
Updated:	May 17 2005 12:00AM
Credit:	Thomas Waldegger <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	WordPress WordPress 1.5
Not Vulnerable:	WordPress WordPress 1.5.1

Wordpress WP-Trackback.PHP SQL Injection Vulnerability

Wordpress is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Wordpress WP-Trackback.PHP SQL Injection Vulnerability

No exploit is required.
http://www.example.com//wp-trackback.php?tb_id=1%20union%20select%200user_pass%20from%20wp_users&url=bla&title=bla

Wordpress WP-Trackback.PHP SQL Injection Vulnerability

Solution:
The vendor has addressed this issue in Wordpress version 1.5.1.


WordPress WordPress 1.5

• WordPress WordPress Latest Release Download
  http://wordpress.org/latest.tar.gz

Wordpress WP-Trackback.PHP SQL Injection Vulnerability

References:

• WordPress 1.5.1 Development (WordPress)
  
• WordPress Homepage (WordPress)