Make WordPress Core

Opened 18 years ago

Closed 18 years ago

Last modified 17 years ago

#2769 closed defect (bug) (fixed)

Non-integer provided as page_id reveals a bug on pages list

Reported by: pcdinh's profile pcdinh Owned by: markjaquith's profile markjaquith
Milestone: Priority: normal
Severity: major Version: 2.1
Component: General Keywords:
Focuses: Cc:

Description

I work with Wordpress 2.1 alpha1 build 2/6/2006 and find that if I send a request like this

http://path/wordpress/?page_id=,
or

http://192.168.1.104/php/wordpress/?page_id=char()

or

http://192.168.1.104/php/wordpress/?page_id=%3Cscript%3E

Live example: http://www.binarymoon.co.uk/?page_id=%22.%22%20or%201%20=%201%22.

I will have a list of all pages following by comments blocks displayed repeatly. It means that page_id is not checked against integer values.

Thanks

pcdinh

Change History (5)

#1 @markjaquith
18 years ago

  • Component changed from Security to General
  • Owner changed from anonymous to markjaquith
  • Severity changed from critical to major
  • Status changed from new to assigned
  • Summary changed from Security implication: Sql injection on page_id reveals a bug on pages list to Non-integer provided as page_id reveals a bug on pages list

It seems that if page_id is not an integer, it is removed from the query altogether (latest trunk)

ELECT * FROM wp_posts  WHERE (post_type = 'page' AND post_status = 'publish')    ORDER BY post_title ASC

No SQL injection potential. Although, blank page_id should probably run a front page query, not a query of all pages!

I'm taking away the "security" marking for this bug, because non-integer data isn't be inserted into the query. In the future, if you thing you've identified a security issue, please send it to security@…

#2 @ryan
18 years ago

  • Resolution set to fixed
  • Status changed from assigned to closed

(In [4132]) Cast page_id to int before deciding if is_page. fixes #2769

#3 @ryan
18 years ago

(In [4232]) Cast page_id to int before deciding if is_page. fixes #2769

#4 @foolswisdom
18 years ago

  • Milestone changed from 2.1 to 2.0.5

#5 @(none)
17 years ago

  • Milestone 2.0.5 deleted

Milestone 2.0.5 deleted

Note: See TracTickets for help on using tickets.