WARNING! Fake news / Disputed / BOGUS

WordPress 2.0.3 SQL Error and Full Path Disclosure

2006-07-07 / 2006-07-08
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89

Dnia 02-07-2006, nie o godzinie 09:15 +0000, xzerox (at) linuxmail (dot) org [email concealed] napisa&Aring;?(a): > Example: > > http://localhost/wordpress/index.php?paged=-1 > > Result: > > WordPress database error: [Erreur de syntaxe pr?s de '-20, 10' ? la ligne 1] > SELECT DISTINCT * FROM wp_posts WHERE 1=1 AND post_date_gmt <= '2006-06-29 12:46:59' AND (post_status = "publish") AND post_status != "attachment" GROUP BY wp_posts.ID ORDER BY post_date DESC LIMIT -20, 10 Put this line somewhere in the wp-settings.php file (for example at the end of the code before the do_action(init) call): $wpdb->hide_errors(); > > ~ Full path ~ > > /wp-settings.php > /wp-admin/admin-footer.php > /wp-admin/admin-functions.php > /wp-admin/edit-form.php in line 60 of wp-settings.php change to: error_reporting(0); Now the World is safe. -- js


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top