6 days after Wordpress 2.2 release,  Janek Vind has discovered a vulnerability in WordPress 2.1.3, which can be exploited  to conduct SQL injection attacks.  Secunia has the scoop on this one :

Input passed to the "cookie" parameter in wp-admin/admin-ajax.php is not properly sanitized before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

As dangerous as this vulnerability seems, the attacker needs to know the database table prefix in order to carry on successful data enumeration.

I wonder how many of these vulnerabilities are found by source code analysis vs. Changelog.txt "reverse engineering"

Original Advisory : http://www.waraxe.us/advisory-50.html

Share This

If you enjoyed this post, make sure you subscribe to my RSS feed!