|
|
>> WordPress SQL Injection and Cross Site Scripting Vulnerabilities
|
Multiple vulnerabilities were identified in WordPress, which could be exploited by malicious users to conduct SQL injection and cross site scripting attacks.
The first issue is due to an input validation error in the "post.php" script when processing specially crafted "comment" or "p" parameters, which may be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser.
The second vulnerability is due to an input validation error in the XMLRPC module when processing a specially crafted "HTTP_RAW_POST_DATA" variable, which may be exploited by remote users to conduct SQL injection attacks.
The third flaw is due to an input validation error in the "wp-login.php" file when processing a specially crafted "message" variable, which may be exploited by remote users to manipulate the "Forgotten Password" option.
The fourth vulnerability resides in the "menu-header.php", "wp-atom.php", "wp-rss.php", and "wp-rss2.php" files, which could be exploited by attackers to determine the installation path.
The fifth issue is due to an input validation in the "comments" posting feature that does not properly validate the "HTTP_USER_AGENT" header, which could be exploited by malicious people to conduct SQL injection attacks.
Affected Products
WordPress version 1.5.x and prior
Solution
Upgrade to the latest 2.x version :
http://wordpress.org/download/
References
http://www.vupen.com/english/advisories/2005/0925
http://www.gulftech.org/?node=research&article_id=00085-06282005
Credits
Vulnerabilities reported by James Bercegay and Patrik Karlsson
ChangeLog
2005-06-30 : Initial release
2005-07-04 : Updated CVE
2006-03-05 : Additional vulnerability (reported in GLSA 200603-01)
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
