2.2 remote SQL injection exploit, user registration, xmlrpc.php.

[drhallows]

Wordpress 2.2 remote SQL injection exploit, user registration, xmlrpc.php.

Apply [5570] int cast to 2.2 branch

[rob1n]

(In [5584]) Apply [5570] to 2.2. fixes #4357

[Otto42]

Note: Exploit code for this (fixed) bug is in the wild:

​http://www.milw0rm.com/exploits/4039
​http://wordpress.org/support/topic/120857

This bug enabled Remote SQL Injection. Might want to put the latest 2.2 out there quickly?

[westi]

Replying to Otto42:

Note: Exploit code for this (fixed) bug is in the wild:

​http://www.milw0rm.com/exploits/4039
​http://wordpress.org/support/topic/120857

This bug enabled Remote SQL Injection.
Might want to put the latest 2.2 out there quickly?

If I read this correctly - isn't the exploit only viable if you have a valid username/password combo to use as there is a login check.

It is therefore only really serious for blogs with user registration enabled.

[Otto42]

Yes, you are correct, you must have at least one valid user/pass combo. It says as much in the exploit code (after running it through Google Translate).

[foolswisdom]

Now widely published.

Wordpress version 2.2 remote SQL injection exploit that makes use of xmlrpc.php.
​http://packetstormsecurity.org/0706-exploits/wp22xmlrpc-sql.txt

​http://kev.coolcavemen.com/2007/06/wordpress-22-security-hole-identity-theft/