Wordpress XMLRPC.PHP SQL注入漏洞

Wordpress是一款基于PHP的WEB应用程序。 Wordpress不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'XMLRPC.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 WordPress WordPress 2.2 目前没有解决方案提供： http://wordpress.org/ http://www.sebug.net/show-exp-1993.html...

DEBIAN-CVE-2007-3140

SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897...

CVE-2007-3140

SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897...

CVE-2007-3140

SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897...

Wordpress 2.2 (xmlrpc.php) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================= Wordpress 2.2 xmlrpc.php Remote SQL Injection Exploit ======================================================= / El error, bastante tonto por cierto, se encuentra en la funcion...

wordpress -- XMLRPC SQL Injection

Secunia reports: Slappter has discovered a vulnerability in WordPress, which can be exploited by malicious users to conduct SQL injection attacks. Input passed to the "wp.suggestCategories" method in xmlrpc.php is not properly sanitised before being used in SQL queries. This can be exploited to...

GLSA-200705-19 : PHP: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200705-19 PHP: Multiple vulnerabilities Several vulnerabilities were found in PHP, most of them during the Month Of PHP Bugs MOPB by Stefan Esser. The most severe of these vulnerabilities are integer overflows in wbmp.c from the G...

Mandrake Linux Security Advisory : php (MDKSA-2007:102)

A heap buffer overflow flaw was found in the xmlrpc extension for PHP. A script that implements an XML-RPC server using this extension could allow a remote attacker to execute arbitrary code as the apache user. This flaw does not, however, affect PHP applications using the pure-PHP XMLRPC class...

CVE-2007-1893

xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publishposts functionality, which can be used to "publish a previously saved post."...

CVE-2007-1893

xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publishposts functionality, which can be used to "publish a previously saved post."...

CVE-2007-1897

SQL injection vulnerability in xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the postid variable...

Sql injection

SQL injection vulnerability in xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the postid variable...

DEBIAN-CVE-2007-1893

xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publishposts functionality, which can be used to "publish a previously saved post."...

DEBIAN-CVE-2007-1897

SQL injection vulnerability in xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the postid variable...

CVE-2007-1893

CVE-2007-1893 affects WordPress 2.1.2 and earlier: remote authenticated users with the contributor role can bypass access restrictions to invoke publish_posts and publish a previously saved post. Connected advisories indicate this issue was addressed in Debian security updates (DSA-1285-1) with f...

CVE-2007-1897

CVE-2007-1897 describes an SQL injection vulnerability in WordPress, specifically in xmlrpc.php (XML RPC mt.setPostCategories call) on WordPress 2.1.2 and earlier. The issue allows remote authenticated users to execute arbitrary SQL commands via a string parameter value related to the post_id var...

CVE-2007-1897

SQL injection vulnerability in xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the postid variable...

CVE-2007-1893

xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publishposts functionality, which can be used to "publish a previously saved post."...

CVE-2007-1897

SQL injection vulnerability in xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the postid variable...

CVE-2007-1893

xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publishposts functionality, which can be used to "publish a previously saved post."...