Comments on: Wordpress 2.3.1 Charset SQL Injection Vulnerability

By: BlogSecurity » Blog Archive » WordPress Insecure by Design?

BlogSecurity » Blog Archive » WordPress Insecure by Design? — Tue, 22 Jan 2008 20:47:16 +0000

[...] security and exploit a UTF-7 SQL Injection exploit some time ago. Another example of this, was Abel Cheung’s Charset SQL Injection vulnerability, published last month (which in theory should still be [...]

By: Wordpress 2.3.1 Charset SQL Injection Vulnerability | MySQL Security

Wordpress 2.3.1 Charset SQL Injection Vulnerability | MySQL Security — Wed, 12 Dec 2007 06:55:23 +0000

[...] more from the original source: Wordpress 2.3.1 Charset SQL Injection Vulnerability ftp securityftp securityRelated Posts [waraxe-2007-SA#059] – XSS in WordPress [...]

By: Abel Cheung

Abel Cheung — Tue, 11 Dec 2007 20:08:22 +0000

My stupidity. Although I originally intend to say removing the function entirely, it was written in such bad way that, the meaning end up like what Flo said. Will update advisory soon.

By: Philipp

Philipp — Tue, 11 Dec 2007 19:00:59 +0000

I can’t talk for Abel, but mostly I believe he’s aiming at removing it in such a way that it’s not working at all anymore(although no direct link to it)

By: Flo

Flo — Tue, 11 Dec 2007 18:44:26 +0000

I doubt that removing search from the theme would help much. One could still trigger the search (and therefore the exploit) over the URL, even if no results were shown.