Description

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.

Remediation

References

CVE-2007-0107

Related Vulnerabilities

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-18097)

Ruby on Rails URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2021-22881)

Twisted Web HTTP Server Improper Certificate Validation Vulnerability (CVE-2014-7143)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-5014)

SugarCRM Other Vulnerability (CVE-2005-0266)

Severity

Medium

Classification

CVE-2007-0107

Tags

Missing Update Known Vulnerabilities