Advisory ID : FrSIRT/ADV-2006-2661
CVE ID : GENERIC-MAP-NOMATCH
Rated as : Low Risk
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2006-07-04

Technical Description

Multiple vulnerabilities have been identified in WordPress, which could be exploited by attackers to gain knowledge of sensitive information.

The first issue is due to an input validation error in the "index.php" script that fails to properly handle a malformed "paged" parameter, which could be exploited by attackers to disclose the database table prefix.

The second flaw is due to errors in various scripts when handling invalid or empty variables, which could be exploited by attackers to determine the installation path.

Affected Products

WordPress version 2.0.3 and prior

Solution

The FrSIRT is not aware of any official supplied patch for this issue.

References

http://www.frsirt.com/english/advisories/2006/2661

Credits

Vulnerabilities reported by zero

ChangeLog

2006-07-04 : Initial release

mmm uno mas para el advisorie de "90% of PHP made programs have Full Path Disclosure"

Una pregunta GracuM, porque borraste el primer post? ya habias publicado uno...

Saludos!!