CVE-2007-0107

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.

Link	Resource
http://www.hardened-php.net/advisory_022007.141.html	Patch Vendor Advisory
http://wordpress.org/development/2007/01/wordpress-206/	Patch
http://www.securityfocus.com/bid/21907	Exploit Patch
http://secunia.com/advisories/23595	Patch Vendor Advisory
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html	Patch Vendor Advisory
http://security.gentoo.org/glsa/glsa-200701-10.xml
http://secunia.com/advisories/23741
http://securityreason.com/securityalert/2112
http://osvdb.org/31579
http://www.vupen.com/english/advisories/2007/0061
https://exchange.xforce.ibmcloud.com/vulnerabilities/31297
http://www.securityfocus.com/archive/1/456049/100/0/threaded

Configuration 1

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

---

Published : 2007-01-09 12:28

Updated : 2018-10-16 04:31

---

NVD link : CVE-2007-0107

Mitre link : CVE-2007-0107

No products.

NVD-CWE-Other