WordPress 'do_trackbacks()' Function SQL Injection Vulnerability

Bugtraq ID:	45131
Class:	Input Validation Error
CVE:	CVE-2010-4257
Remote:	Yes
Local:	No
Published:	Nov 30 2010 12:00AM
Updated:	Apr 13 2015 10:11PM
Credit:	M4g
Vulnerable:	WordPress WordPress 3.0.1 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	WordPress WordPress 3.0.2

WordPress 'do_trackbacks()' Function SQL Injection Vulnerability

WordPress is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

WordPress versions prior to 3.0.2 are affected.

WordPress 'do_trackbacks()' Function SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

WordPress 'do_trackbacks()' Function SQL Injection Vulnerability

References:

• Version 3.0.2 (WordPress)
  
• WordPress 3.0.2 (WordPress)
  
• Wordpress church_admin Plugin "id" Cross-Site Scripting Vulnerability (Sammy Forgit)
  
• WordPress: Information Disclosure via SQL Injection Attack (Vladimir)