NVD

Id
56984  
Name
CVE-2007-4894  
Description
Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the post_type parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters related to "early database escaping" and missing validation of "query string like parameters."  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-09-14  
Modified Date
2011-03-07  
Seq
2007-4894  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
290871 56984 CVE-2007-4894 http://trac.wordpress.org/ticket/4770  View
290872 56984 CVE-2007-4894 http://wordpress.org/development/2007/09/wordpress-223/  View
290873 56984 CVE-2007-4894 http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html  View
290874 56984 CVE-2007-4894 ADV-2007-3132  View
290875 56984 CVE-2007-4894 wordpress-wordpressmu-pingback-sql-injection(36578)  View
290876 56984 CVE-2007-4894 https://bugzilla.redhat.com/show_bug.cgi?id=285831  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
57406 JVNDB-2007-006098 Wordpress および MU における SQL インジェクションの脆弱性 Wordpress および Wordpress マルチユーザ (MU) は、"初期データベースのエスケープ" および "パラメータのようなクエリ文字列" の検証不足の不備があるため、SQL インジェクションの脆弱性が存在します。 CVE-2007-4894 28249 CVE-2007-4894 56984 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-006098.html 2007-09-08 2012-12-20 View