CVE-2007-4894
published 2007-09-14CVE-2007-4894: Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL…
PriorityP339high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
3.64%
88.3th percentile
Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the post_type parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters related to "early database escaping" and missing validation of "query string like parameters."
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 2.2.3-1 (bookworm) | wordpress 2.2.3-1 (bookworm) |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7jph-c3pf-xgjr: Multiple SQL injection vulnerabilities in Wordpress before 2
ghsa_unreviewed·2022-05-01
CVE-2007-4894 [HIGH] CWE-89 GHSA-7jph-c3pf-xgjr: Multiple SQL injection vulnerabilities in Wordpress before 2
Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the post_type parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters related to "early database escaping" and missing validation of "query string like parameters."
OSV
CVE-2007-4894: Multiple SQL injection vulnerabilities in Wordpress before 2
osv·2007-09-14·CVSS 7.5
CVE-2007-4894 [HIGH] CVE-2007-4894: Multiple SQL injection vulnerabilities in Wordpress before 2
Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the post_type parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters related to "early database escaping" and missing validation of "query string like parameters."
Debian
CVE-2007-4894: wordpress - Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress m...
vendor_debian·2007·CVSS 7.5
CVE-2007-4894 [HIGH] CVE-2007-4894: wordpress - Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress m...
Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the post_type parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters related to "early database escaping" and missing validation of "query string like parameters."
Scope: local
bookworm: resolved (fixed in 2.2.3-1)
bullseye: resolved (fixed in 2.2.3-1)
forky: resolved (fixed in 2.2.3-1)
sid: resolved (fixed in 2.2.3-1)
trixie: resolved (fixed in 2.2.3-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://fedoranews.org/updates/FEDORA-2007-214.shtmlhttp://secunia.com/advisories/26771http://secunia.com/advisories/26796http://trac.wordpress.org/ticket/4770http://wordpress.org/development/2007/09/wordpress-223/http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.htmlhttp://www.vupen.com/english/advisories/2007/3132https://bugzilla.redhat.com/show_bug.cgi?id=285831https://exchange.xforce.ibmcloud.com/vulnerabilities/36578http://fedoranews.org/updates/FEDORA-2007-214.shtmlhttp://secunia.com/advisories/26771http://secunia.com/advisories/26796http://trac.wordpress.org/ticket/4770http://wordpress.org/development/2007/09/wordpress-223/http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.htmlhttp://www.vupen.com/english/advisories/2007/3132https://bugzilla.redhat.com/show_bug.cgi?id=285831https://exchange.xforce.ibmcloud.com/vulnerabilities/36578
2007-09-14
Published