From 4b3d8b18ef7a7ef22733fdc1299d0e91297b3813 Mon Sep 17 00:00:00 2001 From: gabor Date: Sat, 9 Jun 2007 15:07:22 +0000 Subject: wordpress -- XMLRPC SQL Injection wordpress -- unmoderated comments disclosure Reviewed by: simon --- security/vuxml/vuln.xml | 71 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) (limited to 'security/vuxml') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 7e99dc615a74..605e1fb8ad73 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,77 @@ Note: Please add new entries to the beginning of this file. --> + + wordpress -- XMLRPC SQL Injection + + + wordpress + de-wordpress + 0 + + + + +

Secunia reports:

+
Slappter has discovered a vulnerability in WordPress, which can + be exploited by malicious users to conduct SQL injection + attacks.
+
Input passed to the "wp.suggestCategories" method in xmlrpc.php + is not properly sanitised before being used in SQL queries. This + can be exploited to manipulate SQL queries by injecting arbitrary + SQL code.
+
Successful exploitation allows e.g. retrieving usernames and + password hashes, but requires valid user credentials and knowledge + of the database table prefix.
+

+ + + + 24344 + http://secunia.com/advisories/25552/ + + + 2007-06-06 + 2007-06-09 + + + + + wordpress -- unmoderated comments disclosure + + + wordpress + de-wordpress + 0 + + + de-wordpress + 0 + + + + +

Blogsecurity reports:

+
An attacker can read comments on posts that have not been + moderated. This can be a real security risk if blog admins + are using unmoderated comments (comments that have not been + made public) to hide sensitive notes regarding posts, future + work, passwords etc. So please be careful if you are one of + these blog admins.
+

+ + + + http://blogsecurity.net/news/news-310507/ + + + 2007-06-01 + 2007-06-09 + + + webmin -- cross site scripting vulnerability -- cgit