Critical WordPress Flaw Found
A critical WordPress vulnerability has been discovered by Alexander Concha.
The Remote SQL Injection vulnerability affects the latest versions of WordPress including Wordpress <= 2.2.2 and Wordpress MU <= 1.2.4.
Alexander has also written a proof of concept exploit for the vulnerability. He has contacted WordPress regarding the hole. A patch cannot be released without disclosing to much information regarding the hole, however, we hope this post will motivate WordPress to release a fix earlier rather then later.
As a side note, Alex claims to have also found a bunch of other SQL Injection and XSS findings. Nice work Alex.
Random Posts
If you enjoyed this post, please leave a comment or subscribe to the feed and get future articles delivered to your feed reader.
Comments
[WordPress] Neue SQL – Injection verwundbarkeit entdeckt…
Alexander Concha hat wohl eine neue Lücke in der aktuellen Version von WordPress (2.2.2) gefunden.
Ein Proof-of-Concept existiert auch, WordPress ist informiert, aber einen Fix, bzw. einen “manuellen” Fix gibt es noch nicht, da dies…
[...] tipo de llamadas y gracias a ciertas características de WordPress, fue posible hacer funcionar el tan publicitado exploit para una vulnerabilidad que afecta a casi todas las versiones de este [...]
[...] Agreeable Openness August 24th, 2007 Well, again we’ve got folks claiming to have found a remote SQL injection in WordPress, one that affects all versions. At least the discoverer, Alexander Concha, did the right thing: notifying the WP folks. He’s [...]
[...] Blogsecurity am 22.08. berichtete, wurde eine kritische Sicherheitslücke in WordPress entdeckt, die wohl alle Versionen bis [...]
[...] and others raised. That is very good. Thanks, guys. And for the record, it was 16 days between notice and release. Very [...]
[...] WordPress.com, WordCamps in Beijing and Israel, Censorship in Turkey, and More WordPress News users. Mark Jaquith reports on some of the security issues covered by this update. Read More [...]
[...] Aber zu Wordpress 2.2.3 gibt es ein Detail, das ich sehr intressant finde. Zitat sw-guide.de: Wie Blogsecurity am 22.08. berichtete, wurde eine kritische Sicherheitsl
[...] users. Mark Jaquith reports on some of the security issues covered by this update. ALERT: Blog Security reports a security flaw has been uncovered and reported to WordPress. Expect a new security update to be released soon as [...]