|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> CGI abuses >> WordPress < 1.5.1 Multiple Vulnerabilities Vulnerability Assessment Details
|
WordPress < 1.5.1 Multiple Vulnerabilities |
||
Checks for multiple vulnerabilities in WordPress < 1.5.1 Detailed Explanation for this Vulnerability Assessment Summary : The remote web server contains multiple PHP scripts that are prone to SQL injection and cross-site scripting attacks. Description : The version of WordPress installed on the remote host suffers from multiple vulnerabilities: - A SQL Injection Vulnerability WordPress fails to properly sanitize user input passed via the 'tb_id' parameter to the 'wp-trackback.php' script before using it in database queries. This could lead to disclosure of sensitive information or even attacks against the underlying database. - Multiple Cross-Site Scripting Vulnerabilities. A possible hacker can pass arbitrary HTML and script code through the 's' parameter of the 'wp-admin/edit.php' script or the 'p' parameter in the 'wp-admin/post.php' script, thereby facilitating cross-site scripting attacks. Note, though, that these attacks will only be successful against administrators since the scripts themselves are limited to administrators. See also : http://wordpress.org/development/2005/05/one-five-one/ Solution : Upgrade to WordPress version 1.5.1 or later. Network Security Threat Level: Medium / CVSS Base Score : 5 (AV:R/AC:L/Au:NR/C:P/A:N/I:P/B:N) Networks Security ID: 13655, 13663, 13664 Vulnerability Assessment Copyright: This script is Copyright (C) 2005 Tenable Network Security |
||
Cables, Connectors |
Vintage Apple Macintosh SE Case - Empty Shell - Housing retro project
$60.00
Vintage 1980s IBM PC Jr Model 4860 Desktop Tower Computer W/2 EXPANSIONS
$100.00
Computer Lab International 122 Key Vintage Keyboard PS/2 TESTED
$88.88
Vintage CARDCO Vic-20 C64 +4 C16 and C128 Parallel Printer Interface Card - QTY
$19.99
Socket 3 VLB/ISA/PCI Motherboard, FIC 486-VIP-IO2, 486DX4-100 + 4mb Vintage
$199.99
(5) Vintage DiskBank floppy Disk Storage Holders Vintage
$29.95
Vintage 1991 Hewlett Packard DeskJet 500 Printer Manual Bundle W Floppy Disk
$23.99
Vintage Microsoft Office 2000 Premium 4 CDs + Product Keys + Service Pack CD
$59.99
Vintage 1986 IBM 1389262 Model M buckling spring terminal keyboard -1 keycap
$150.00
Vintage 1989 Macintosh Adobe Type Manager User Guide
$30.00
|
||
No Discussions have been posted on this vulnerability. |