WordPress 4.2.3 and earlier SQL Injection Vulnerability

A potential SQL injection that could be used to compromise a site

FIX:
trunk/src/wp-includes/post.php
foreach ( $group_by_status as $status => $comments ) {
// Sanity check. This shouldn't happen.
- if ( 'post-trashed' == $status )
+ if ( 'post-trashed' == $status ) {
$status = '0';
- $comments_in = implode( "', '", $comments );
- $wpdb->query( "UPDATE $wpdb->comments SET comment_approved = '$status' WHERE comment_ID IN ('" . $comments_in . "')" );
+ }
+ $comments_in = implode( ', ', array_map( 'intval', $comments ) );
+ $wpdb->query( $wpdb->prepare( "UPDATE $wpdb->comments SET comment_approved = %s WHERE comment_ID IN ($comments_in)", $status ) );
}

#  0day.today [2018-01-03]  #