CVE-2007-0107
medium · 6.8WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.
6.8
CVSS
11.4%
EPSS (exploit prob.)
96th
EPSS percentile
2007-01-09
Published
AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| wordpress | wordpress | <= 2.0.5 |
Check a specific version with /api/v1/cve/match.
References
- http://osvdb.org/31579
- http://secunia.com/advisories/23595
- http://secunia.com/advisories/23741
- http://security.gentoo.org/glsa/glsa-200701-10.xml
- http://securityreason.com/securityalert/2112
- http://wordpress.org/development/2007/01/wordpress-206/
- http://www.hardened-php.net/advisory_022007.141.html
- http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html
- http://www.securityfocus.com/archive/1/456049/100/0/threaded
- http://www.securityfocus.com/bid/21907
- http://www.vupen.com/english/advisories/2007/0061
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31297
- http://osvdb.org/31579
- http://secunia.com/advisories/23595
- http://secunia.com/advisories/23741
- http://security.gentoo.org/glsa/glsa-200701-10.xml
- http://securityreason.com/securityalert/2112
- http://wordpress.org/development/2007/01/wordpress-206/
- http://www.hardened-php.net/advisory_022007.141.html
- http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html
- http://www.securityfocus.com/archive/1/456049/100/0/threaded
- http://www.securityfocus.com/bid/21907
- http://www.vupen.com/english/advisories/2007/0061
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31297
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2007-0107