CVE-2007-0107

Опубликовано: 09 янв. 2007

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.

Ссылки

http://osvdb.org/31579
http://secunia.com/advisories/23595
Patch
Vendor Advisory
http://secunia.com/advisories/23741
http://security.gentoo.org/glsa/glsa-200701-10.xml
http://securityreason.com/securityalert/2112
http://wordpress.org/development/2007/01/wordpress-206/
Patch
http://www.hardened-php.net/advisory_022007.141.html
Patch
Vendor Advisory
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/456049/100/0/threaded
http://www.securityfocus.com/bid/21907
Exploit
Patch
http://www.vupen.com/english/advisories/2007/0061
https://exchange.xforce.ibmcloud.com/vulnerabilities/31297
http://osvdb.org/31579
http://secunia.com/advisories/23595
Patch
Vendor Advisory
http://secunia.com/advisories/23741
http://security.gentoo.org/glsa/glsa-200701-10.xml
http://securityreason.com/securityalert/2112
http://wordpress.org/development/2007/01/wordpress-206/
Patch
http://www.hardened-php.net/advisory_022007.141.html
Patch
Vendor Advisory
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Версия до 2.0.5 (включая)

EPSS

Процентиль: 91%

0.06324

Низкий

6.8 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

CVE-2007-0107

ubuntu

больше 18 лет назад

CVE-2007-0107

debian

больше 18 лет назад

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alte ...

GHSA-mm56-chx8-v576

github

больше 3 лет назад

EPSS

Процентиль: 91%

0.06324

Низкий

6.8 Medium

CVSS2

Дефекты

NVD-CWE-Other