Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-3140 — SQL Injection in Wordpress

12 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
2.6%
top 14.42%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
WordpressDebian Wordpress
Timeline
PublishedJun 8
Latest updateMay 1

Description

SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 8.0 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 2.2.1-1 (bookworm)
▶Debianwordpress/wordpress< 2.2.1-1+3

🔴Vulnerability Details

2
GHSA
GHSA-m425-pqwf-xvhx: SQL injection vulnerability in xmlrpc↗2022-05-01
▶
OSV
CVE-2007-3140: SQL injection vulnerability in xmlrpc↗2007-06-08
▶

💥Exploits & PoCs

1
Exploit-DB
WordPress Core 2.2 - 'xmlrpc.php' SQL Injection↗2007-06-06
▶

🔍Detection Rules

6
Suricata
ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php SELECT↗2010-07-30
▶
Suricata
ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php INSERT↗2010-07-30
▶
Suricata
ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php ASCII↗2010-07-30
▶
Suricata
ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php UNION SELECT↗2010-07-30
▶
Suricata
ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php UPDATE↗2010-07-30
▶

📋Vendor Advisories

1
Debian
CVE-2007-3140: wordpress - SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authent...↗2007
▶

💬Community

1
Bugzilla
Wordpress 2.2(.1): SQL injection, XSS, unrestricted file upload vulnerabilities↗2007-06-21
▶
CVE-2007-3140 — SQL Injection in Debian Wordpress | cvebase