CVE-2007-4894
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
8.3 High
AI Score
Confidence
Low
0.004 Low
EPSS
Percentile
74.1%
Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the post_type parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters related to “early database escaping” and missing validation of “query string like parameters.”
Affected configurations
References
fedoranews.org/updates/FEDORA-2007-214.shtml
secunia.com/advisories/26771
secunia.com/advisories/26796
trac.wordpress.org/ticket/4770
wordpress.org/development/2007/09/wordpress-223/
www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html
www.vupen.com/english/advisories/2007/3132
bugzilla.redhat.com/show_bug.cgi?id=285831
exchange.xforce.ibmcloud.com/vulnerabilities/36578
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
8.3 High
AI Score
Confidence
Low
0.004 Low
EPSS
Percentile
74.1%