vulnwire
6.8med

CVE-2007-01071 exploit

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remot…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
6.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
11.7%
percentile 96%
Public exploits
1
Exploit-DB

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.

Exploit prediction (EPSS)

11.71% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

Exploits and detections

  • EDB-3095 WordPress Core 2.0.5 - Trackback UTF-7 SQL Injection · webapps · 2007-01-07

CVSS scores

Assigned byVersionScoreVector
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Technology feeds
WordPress (RSS, critical only)

References

  • exchange.xforce.ibmcloud.com /vulnerabilities/31297 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/21907 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/23741 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • openpkg.com /security/advisories/OpenPKG-SA-2007.005.html · vendor-advisory, x_refsource_OPENPKG, x_transferred
  • security.gentoo.org /glsa/glsa-200701-10.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • osvdb.org /31579 · vdb-entry, x_refsource_OSVDB, x_transferred
  • wordpress.org /development/2007/01/wordpress-206/ · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/23595 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/456049/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • vupen.com /english/advisories/2007/0061 · vdb-entry, x_refsource_VUPEN, x_transferred
  • hardened-php.net /advisory_022007.141.html · x_refsource_MISC, x_transferred
  • securityreason.com /securityalert/2112 · third-party-advisory, x_refsource_SREASON, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.