WordPress Post_ID Parameter SQL Injection Vulnerability

[W. Scott Lockwood III]

Binary package hint: wordpress

WordPress Post_ID Parameter SQL Injection Vulnerability

Bugtraq ID: 23294
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: Apr 03 2007 12:00AM
Updated: Apr 05 2007 03:52PM
Credit: <email address hidden> is credited with the discovery of this vulnerability.
Vulnerable: WordPress WordPress 2.1.2

WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

WordPress 2.1.2 is vulnerable to this issue; other versions may also be affected

Attackers can use a browser to exploit this issue.

The following proof-of-concept exploit is available:
http://www.securityfocus.com/data/vulnerabilities/exploits/23294.pl

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:<email address hidden>.

References:

    * WordPress Homepage (WordPress) http://wordpress.org/

[W. Scott Lockwood III (wsl3)]

Solution:
Update to version 2.1.3.

[W. Scott Lockwood III (wsl3)]

Sorry for the double comment, per http://secunia.com/advisories/24751/ Update to version 2.1.3.

[Michael Bienia (geser)]

Feisty has already WP 2.1.3.

[W. Scott Lockwood III (wsl3)]

This isn't for Feisty - did I file the bug in the wrong area? This is for LTS.

[Tony Yarusso (tonyyarusso)]

Note that since Wordpress is in the universe section of the repositories, it does NOT receive any review or updates from the Ubuntu Security Team (as clearly stated in /etc/apt/sources.list). It would however still be nice to have this closed, if the maintainer could take a moment to address it.
Concerns universe in dapper, dapper-backports, edgy, edgy-backports.

[Harrison Conlin (harrisony)]

Ubuntu Security doesn't want it, but im sure MOTU security can handle 1 extra bug

[Hew (hew)]

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.