CVE - CVE-2007-0107

CVE-ID
CVE-2007-0107	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:21907 URL:http://www.securityfocus.com/bid/21907 BUGTRAQ:20070105 Advisory 02/2007: WordPress Trackback Charset Decoding SQL Injection Vulnerability URL:http://www.securityfocus.com/archive/1/456049/100/0/threaded CONFIRM:http://wordpress.org/development/2007/01/wordpress-206/ GENTOO:GLSA-200701-10 URL:http://security.gentoo.org/glsa/glsa-200701-10.xml MISC:http://www.hardened-php.net/advisory_022007.141.html OPENPKG:OpenPKG-SA-2007.005 URL:http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html OSVDB:31579 URL:~~http://osvdb.org/31579~~ (Obsolete source) SECUNIA:23595 URL:http://secunia.com/advisories/23595 SECUNIA:23741 URL:http://secunia.com/advisories/23741 SREASON:2112 URL:http://securityreason.com/securityalert/2112 VUPEN:ADV-2007-0061 URL:~~http://www.vupen.com/english/advisories/2007/0061~~ (Obsolete source) XF:wordpress-mbstring-security-bypass(31297) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/31297
Assigning CNA
MITRE Corporation
Date Record Created
20070108	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20070108)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)