WordPress <=4.8.2 - potential SQL injection (SQLi), $wpdb->prepare() issue, possible unsafe queries

Possible security issue found by Anthony Ferrara in WordPress versions =4.8.2. WordPress is not vulnerable itself, but themes or plugins could trigger the vulnerability. Solution Update WordPress to the latest available version at least version 4.8.3...

wordpress -- multiple issues

wordpress developers reports: WordPress versions 4.8.2 and earlier are affected by an issue where $wpdb-prepare can create unexpected and unsafe queries leading to potential SQL injection SQLi. WordPress core is not directly vulnerable to this issue, but we've added hardening to prevent plugins a...

UBUNTU-CVE-2017-14723

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

DEBIAN-CVE-2017-14723

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

CVE-2017-14723

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

Sql injection

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

CVE-2017-14723

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

CVE-2017-14723

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

EUVD-2017-6220

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

PT-2017-13652

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.8.2 Description The issue arises from the mishandling of % characters and additional placeholder values in $wpdb-prepare, which could enable SQL injection attacks if plugins or themes are not properly secured...

CVE-2017-14723: Improper Neutralization of Special Elements used in an SQL Command

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

WordPress 2.3.0-4.8.1 - $wpdb->prepare() potential SQL Injection

...

Wordpress SQLi

Source 1:https://medium. com/websec/wordpress-sqli-bbb2afcc8e94 Wordpress SQLi There won't be an intro, let us jump to the problem. This is the wordpress database abstraction the prepare method code: public function prepare $query, $args if isnull $query return; // This is not meant to be foolpro...

CVE-2017-8420

Removed by vendor...

Linux/x86 - XOR encoded execve(/bin/sh) setuid(0) setgid(0) Shellcode (66 bytes)

Linux/x86 - XOR encoded execve/bin/sh setuid0 setgid0 Shellcode 66 bytes. Shellcode exploit for Linx86 platform ;Title: Linux/x86 - 66 byte - execve/bin/sh - setuid0 - setgid0 - XOR encrypted ;Author: nullparasite ;Contact: [email protected] ;Category: Shellcode ;Architecture: Linux x86...

PT-2017-16796

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.9.10 Description The issue allows attackers to cause a denial of service, potentially leading to a system crash. This can be achieved through either an application making crafted system calls or possibly throug...

DEBIAN-CVE-2016-1251

There is a vulnerability of type use-after-free affecting DBD::mysql aka DBD-mysql or the Database Interface DBI MySQL driver for Perl 3.x and 4.x before 4.041 when used with mysqlserverprepare=1...

UBUNTU-CVE-2016-1251

There is a vulnerability of type use-after-free affecting DBD::mysql aka DBD-mysql or the Database Interface DBI MySQL driver for Perl 3.x and 4.x before 4.041 when used with mysqlserverprepare=1...

PT-2016-4671 · Mysql Server +3 · Dbd::Mysql +3

Name of the Vulnerable Software and Affected Versions: DBD::mysql versions 3.x and 4.x before 4.041 Description: The issue is related to a use-after-free vulnerability. It affects the DBD::mysql driver when used with the option mysql server prepare=1. Recommendations: For DBD::mysql versions 3.x...

MariaDB 10.0.0 < 10.0.24 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.0.24. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.24 advisory. - Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before...