Vulnerabilities > CVE-2005-1810 - SQL Injection vulnerability in Wordpress 1.5.1

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
wordpress
nessus

Summary

SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $cat_ID variable, as demonstrated using the cat parameter to index.php.

Vulnerable Configurations

Part Description Count
Application
Wordpress
1

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200506-04.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200506-04 (Wordpress: Multiple vulnerabilities) Due to a lack of input validation, WordPress is vulnerable to SQL injection and XSS attacks. Impact : An attacker could use the SQL injection vulnerabilities to gain information from the database. Furthermore the cross-site scripting issues give an attacker the ability to inject and execute malicious script code or to steal cookie-based authentication credentials, potentially compromising the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id18427
    published2005-06-07
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/18427
    titleGLSA-200506-04 : Wordpress: Multiple vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200506-04.
    #
    # The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(18427);
      script_version("1.16");
      script_cvs_date("Date: 2019/08/02 13:32:42");
    
      script_cve_id("CVE-2005-1102", "CVE-2005-1687", "CVE-2005-1810");
      script_xref(name:"GLSA", value:"200506-04");
    
      script_name(english:"GLSA-200506-04 : Wordpress: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200506-04
    (Wordpress: Multiple vulnerabilities)
    
        Due to a lack of input validation, WordPress is vulnerable to SQL
        injection and XSS attacks.
      
    Impact :
    
        An attacker could use the SQL injection vulnerabilities to gain
        information from the database. Furthermore the cross-site scripting
        issues give an attacker the ability to inject and execute malicious
        script code or to steal cookie-based authentication credentials,
        potentially compromising the victim's browser.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200506-04"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Wordpress users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=www-apps/wordpress-1.5.1.2'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:wordpress");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/06/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/06/07");
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/05/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"www-apps/wordpress", unaffected:make_list("ge 1.5.1.2"), vulnerable:make_list("lt 1.5.1.2"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Wordpress");
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_A4955B32ED8411D983100001020EED82.NASL
    descriptionA Gentoo Linux Security Advisory reports : Due to a lack of input validation, WordPress is vulnerable to SQL injection and XSS attacks. An attacker could use the SQL injection vulnerabilities to gain information from the database. Furthermore the cross-site scripting issues give an attacker the ability to inject and execute malicious script code or to steal cookie-based authentication credentials, potentially compromising the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id19058
    published2005-07-13
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/19058
    titleFreeBSD : wordpress -- multiple vulnerabilities (a4955b32-ed84-11d9-8310-0001020eed82)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(19058);
      script_version("1.15");
      script_cvs_date("Date: 2019/08/02 13:32:37");
    
      script_cve_id("CVE-2005-1810");
    
      script_name(english:"FreeBSD : wordpress -- multiple vulnerabilities (a4955b32-ed84-11d9-8310-0001020eed82)");
      script_summary(english:"Checks for updated package in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote FreeBSD host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A Gentoo Linux Security Advisory reports :
    
    Due to a lack of input validation, WordPress is vulnerable to SQL
    injection and XSS attacks.
    
    An attacker could use the SQL injection vulnerabilities to gain
    information from the database. Furthermore the cross-site scripting
    issues give an attacker the ability to inject and execute malicious
    script code or to steal cookie-based authentication credentials,
    potentially compromising the victim's browser."
      );
      # http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200506-04"
      );
      # https://vuxml.freebsd.org/freebsd/a4955b32-ed84-11d9-8310-0001020eed82.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?56caec89"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:wordpress");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/04/12");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/07/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/07/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"wordpress<1.5.1.2,1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyCGI abuses
    NASL idWORDPRESS_CAT_ID_SQL_INJECTION.NASL
    descriptionThe version of WordPress installed on the remote host fails to properly sanitize user-supplied input to the
    last seen2020-06-01
    modified2020-06-02
    plugin id18420
    published2005-06-06
    reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/18420
    titleWordPress 'template-functions-category.php' 'cat_ID' Parameter SQL Injection
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(18420);
      script_version("1.22");
      script_cvs_date("Date: 2018/11/15 20:50:19");
    
      script_cve_id("CVE-2005-1810");
      script_bugtraq_id(13809);
    
      script_name(english:"WordPress 'template-functions-category.php' 'cat_ID' Parameter SQL Injection");
      script_summary(english:"Checks version of WordPress.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote web server contains a PHP script that is affected by a SQL
    injection attack.");
      script_set_attribute(attribute:"description", value:
    "The version of WordPress installed on the remote host fails to
    properly sanitize user-supplied input to the 'cat_ID' variable in the
    'template-functions-category.php' script. This failure may allow an
    attacker to influence database queries resulting in the disclosure of
    sensitive information.
    
    Note that Nessus has not tested for this issue but has instead relied
    only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://marc.info/?l=bugtraq&m=111817436619067&w=2");
      script_set_attribute(attribute:"see_also", value:"https://wordpress.org/news/2005/05/security-update/");
      script_set_attribute(attribute:"solution", value:"Upgrade to WordPress version 1.5.1.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/05/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/05/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/06/06");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:wordpress:wordpress");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.");
    
      script_dependencies("wordpress_detect.nasl");
      script_require_keys("www/PHP", "installed_sw/WordPress", "Settings/ParanoidReport");
      script_require_ports("Services/www", 80);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    include("install_func.inc");
    
    app = "WordPress";
    get_install_count(app_name:app, exit_if_zero:TRUE);
    
    port = get_http_port(default:80, php:TRUE);
    
    install = get_single_install(
      app_name : app,
      port     : port,
      exit_if_unknown_ver : TRUE
    );
    
    dir = install['path'];
    ver = install['version'];
    install_url = build_url(port:port, qs:dir);
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    if (ver =~ "^(0\.|1\.([0-4]|5([^0-9.]+|$|\.0|\.1([^0-9.]|$)|\.1\.[01][^0-9])))"){
      set_kb_item(name: 'www/'+port+'/SQLInjection', value: TRUE);
    
      if (report_verbosity > 0)
      {
        report =
          '\n  URL               : ' + install_url +
          '\n  Installed version : ' + ver +
          '\n  Fixed version     : 1.5.1.2\n';
        security_hole(port:port, extra:report);
      }
      else security_hole(port);
      exit(0);
    }
    else audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url, ver);