National Cyber Awareness System

Vulnerability Summary for CVE-2007-1897

Overview

SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the post_id variable.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

This vulnerability has been addressed by the vendor with the release of the following product update: http://wordpress.org/development/2007/04/wordpress-213-and-2010/}

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: SECUNIA

Name: 24751

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/24751

External Source: VUPEN

Name: ADV-2007-1245

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2007/1245

External Source: BID

Name: 23294

Type: Advisory; Exploit

Hyperlink:http://www.securityfocus.com/bid/23294

External Source: MISC

Name: http://www.notsosecure.com/folder2/2007/04/03/wordpress-212-xmlrpc-security-issues/

Type: Advisory; Exploit

Hyperlink:http://www.notsosecure.com/folder2/2007/04/03/wordpress-212-xmlrpc-security-issues/

External Source: MILW0RM

Name: 3656

Hyperlink:http://www.milw0rm.com/exploits/3656

External Source: DEBIAN

Name: DSA-1285

Hyperlink:http://www.debian.org/security/2007/dsa-1285

External Source: CONFIRM

Name: http://trac.wordpress.org/ticket/4091

Hyperlink:http://trac.wordpress.org/ticket/4091

External Source: SECUNIA

Name: 25108

Type: Advisory

Hyperlink:http://secunia.com/advisories/25108