CVE

Id
23464  
CVE No.
CVE-2007-0107  
Status
Candidate  
Description
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.  
Phase
Assigned (20070108)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
226991 23464 CVE-2007-0107 BUGTRAQ:20070105 Advisory 02/2007: WordPress Trackback Charset Decoding SQL Injection Vulnerability  View
226992 23464 CVE-2007-0107 URL:http://www.securityfocus.com/archive/1/archive/1/456049/100/0/threaded  View
226993 23464 CVE-2007-0107 MISC:http://www.hardened-php.net/advisory_022007.141.html  View
226994 23464 CVE-2007-0107 CONFIRM:http://wordpress.org/development/2007/01/wordpress-206/  View
226995 23464 CVE-2007-0107 GENTOO:GLSA-200701-10  View
226996 23464 CVE-2007-0107 URL:http://security.gentoo.org/glsa/glsa-200701-10.xml  View
226997 23464 CVE-2007-0107 OPENPKG:OpenPKG-SA-2007.005  View
226998 23464 CVE-2007-0107 URL:http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html  View
226999 23464 CVE-2007-0107 BID:21907  View
227000 23464 CVE-2007-0107 URL:http://www.securityfocus.com/bid/21907  View
227001 23464 CVE-2007-0107 VUPEN:ADV-2007-0061  View
227002 23464 CVE-2007-0107 URL:http://www.vupen.com/english/advisories/2007/0061  View
227003 23464 CVE-2007-0107 OSVDB:31579  View
227004 23464 CVE-2007-0107 URL:http://osvdb.org/31579  View
227005 23464 CVE-2007-0107 SECUNIA:23595  View
227006 23464 CVE-2007-0107 URL:http://secunia.com/advisories/23595  View
227007 23464 CVE-2007-0107 SECUNIA:23741  View
227008 23464 CVE-2007-0107 URL:http://secunia.com/advisories/23741  View
227009 23464 CVE-2007-0107 SREASON:2112  View
227010 23464 CVE-2007-0107 URL:http://securityreason.com/securityalert/2112  View
227011 23464 CVE-2007-0107 XF:wordpress-mbstring-security-bypass(31297)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
56225 JVNDB-2007-004917 WordPress の wp-login.php における重要な情報を取得される脆弱性 WordPress の wp-login.php は、ユーザがログアウトしているか否かで異なるエラーメッセージを表示するため、重要な情報を取得される、または総当り攻撃を仕掛けられる脆弱性が存在します。 CVE-2007-0109 23464 5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-004917.html  View