[wp-hackers] Sql injection admin hash disclosure exploit for wp-trackback.php

[Computer Guru]

>From the sheet:


/*********************************************************************\
Wordpress <= 2.0.6 wp-trackback.php Zend_Hash_Del_Key_Or_Index /
/ sql injection admin hash disclosure exploit
(needs register_globals=on, 4 <= PHP < 4.4.3,< 5.1.4)
by rgod
dork: "is proudly powered by WordPress"
mail: retrog at alice dot it
site: http://retrogod.altervista.org
/*********************************************************************\

Only affects less than 2.0.6, which was a security update.

Computer Guru
NeoSmart Technologies
http://neosmart.net/blog/

> -----Original Message-----
> From: wp-hackers-bounces at lists.automattic.com [mailto:wp-hackers-
> bounces at lists.automattic.com] On Behalf Of martin at wiso.cz
> Sent: Wednesday, January 10, 2007 1:02 PM
> To: wp-hackers at lists.automattic.com
> Subject: [wp-hackers] Sql injection admin hash disclosure exploit for
> wp-trackback.php
> 
> Hello all, I found that there is a new exploit for wp-trackback.php
> script
> using Sql Injection. Details can be found here -
> http://milw0rm.com/exploits/3109
> 
> Does anyone test it? I have to say that for some of my installations of
> WP
> it works and for other not. I did some quick fix for this specific
> exploit, but it is not ideal...
> 
> Kind regards,
> 
> Martin Wiso
> ==================
> WWW: www.wiso.cz
> 
> _______________________________________________
> wp-hackers mailing list
> wp-hackers at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-hackers