VulnerabilityModified
CVE-2007-0107
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets,…
MEDIUM 6.8EPSS 7.59%
Does this matter?
Lower severity and a low EPSS score (7.59%). Track it; it rarely justifies an emergency change on its own.
Description
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 7.59% probability · 94th percentile
- CISA KEV
- Not listed
- Affected
- wordpress/wordpress
- Source
- cve@mitre.org
References
- http://osvdb.org/31579
- http://secunia.com/advisories/23595Patch, Vendor Advisory
- http://secunia.com/advisories/23741
- http://security.gentoo.org/glsa/glsa-200701-10.xml
- http://securityreason.com/securityalert/2112
- http://wordpress.org/development/2007/01/wordpress-206/Patch
- http://www.hardened-php.net/advisory_022007.141.htmlPatch, Vendor Advisory
- http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/archive/1/456049/100/0/threaded
- http://www.securityfocus.com/bid/21907Exploit, Patch
- http://www.vupen.com/english/advisories/2007/0061
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31297
- http://osvdb.org/31579
- http://secunia.com/advisories/23595Patch, Vendor Advisory
- http://secunia.com/advisories/23741
- http://security.gentoo.org/glsa/glsa-200701-10.xml
- http://securityreason.com/securityalert/2112
- http://wordpress.org/development/2007/01/wordpress-206/Patch
- http://www.hardened-php.net/advisory_022007.141.htmlPatch, Vendor Advisory
- http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/archive/1/456049/100/0/threaded
- http://www.securityfocus.com/bid/21907Exploit, Patch
- http://www.vupen.com/english/advisories/2007/0061
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31297
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.