Wordpress "admin-ajax.php" Sql Injection

[TCH-Thomas]

From: Secunia (http://secunia.com/advisories/25345/)

Rating: Moderately critical

 

Description:

Janek Vind has discovered a vulnerability in WordPress, which can be exploited by malicious people to conduct SQL injection attacks.

 

Input passed to the "cookie" parameter in wp-admin/admin-ajax.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

 

Successful exploitation allows e.g. retrieving administrator password hashes, but requires knowledge of the database table prefix.

 

The vulnerability is confirmed in version 2.1.3. Prior versions may also be affected.

 

Solution:

Update to version 2.2.

 

Wordpress 2.2 was released on May 16. For those who missed the announcement, please click here.

[TCH-Bruce]

Well, I've upgraded. Guess I'm safe for now. Thanks Thomas.

[TCH-Don]

Thanks Thomas

[TCH-James]

Thanks Thomas.

 

Guess I'll have to upgrade my WP now... just been too lazy.

[TCH-Don]

Cool!

I followed their upgrade instructions and it worked very quickly.

[abinidi]

Do you know if this vulnerability affects the 2.0.x code base?

[TCH-Bruce]

The vulnerability is confirmed in version 2.1.3. Prior versions may also be affected.

[abinidi]

But where they aren't clear is whether prior versions of the 2.1.x code line could be affected, or whether prior versions of 2.0.x code line might be affected as well.

[TCH-Bruce]

Exactly. That's all the information that was provided. To be sure upgrade.

[carbonize]

Hmm isn't the version being offered in Fantastico vulnerable? I don't have access to my cPanel from here as works ave blocked my domain.

[TCH-Thomas]

Yes. But hopefully the Fantastico people will release an update soon.

[carbonize]

Does TC have any control over the Fantastico on here? I mean I just installed WP via Fantastico to play with it and I am aware it is out of date but many people just install stuff from Fantastico and don't bother to check if it's the latest version or even check for updates in the future.

[TCH-Bruce]

No, that's gets updated by the Fantastico people. And they are usually at least one rev behind most of the time. I always do manual installs. It's not that difficult.

[carbonize]

I was thinking more of TC adding a notice on the Fantastico page saying that the scripts offered are possibly out of date and that the person installing should check for updates once the script has been installed as it is easier to update than to install from scratch.

[TCH-Bruce]

Since cPanel updates are pushed out constantly there is no current method to add comments to it. Maybe a future version of cPanel will allow for comments to be added generically so notifications can be added easily.