Sql Injection and Path Disclosoure Wordpress v2.0.5

[vannovax@gmail.com]

Version Afected: v2.0.5 - v2.0.2

For Version v2.0.2

index.php?paged=-25633&header.php?=-id

For Version v2.0.5
index.php?paged=/archive/-1-5-2-Create%20Table

PATH DISCLOSOURE

/wp-settings.php

/wp-admin/admin-footer.php

/wp-admin/admin-functions.php

/wp-admin/edit-form.php

/wp-admin/edit-form-advanced.php

/wp-admin/edit-form-comment.php

/wp-admin/edit-link-form.php

/wp-admin/edit-page-form.php

/wp-admin/menu.php

/wp-admin/menu-header.php

/wp-admin/upgrade-functions.php

/wp-admin/upgrade-schema.php

/wp-admin/import/blogger.php

/wp-admin/import/dotclear.php

/wp-admin/import/livejournal.php

/wp-admin/import/mt.php

/wp-admin/import/rss.php

/wp-admin/import/textpattern.php

/wp-content/plugins/hello.php

/wp-content/plugins/wp-db-backup.php

/wp-content/plugins/akismet/akismet.php

/wp-content/themes/classic/index.php

/wp-content/themes/classic/comments.php

/wp-content/themes/classic/comments-popup.php

/wp-content/themes/classic/footer.php

/wp-content/themes/classic/header.php

/wp-content/themes/classic/sidebar.php

/wp-content/themes/default/index.php

/wp-content/themes/default/404.php

/wp-content/themes/default/archive.php

/wp-content/themes/default/archives.php

/wp-content/themes/default/attachment.php

/wp-content/themes/default/comments-popup.php

/wp-content/themes/default/footer.php

/wp-content/themes/default/functions.php

/wp-content/themes/default/header.php

/wp-content/themes/default/links.php

/wp-content/themes/default/page.php

/wp-content/themes/default/search.php

/wp-content/themes/default/searchform.php

/wp-content/themes/default/sidebar.php

/wp-content/themes/default/single.php

/wp-includes/default-filters.php

/wp-includes/kses.php

/wp-includes/locale.php

/wp-includes/rss-functions.php

/wp-includes/template-loader.php

/wp-includes/vars.php

/wp-includes/wp-db.php


NO CRITICAL :-)

[false.hopes@gmail.com]

vannovax@gmail.com wrote:
> Version Afected: v2.0.5 - v2.0.2
>
> For Version v2.0.2
>
> index.php?paged=-25633&header.php?=-id
>
> For Version v2.0.5
> index.php?paged=/archive/-1-5-2-Create%20Table

$_GET['paged'] is cast to an integer and then its absolute value is
fetched. These are both crap.

>
> PATH DISCLOSOURE

.... is also crap. Turn error reporting off on your server.
>
> /wp-settings.php
>
> /wp-admin/admin-footer.php
>
> /wp-admin/admin-functions.php
>
> /wp-admin/edit-form.php
>
> /wp-admin/edit-form-advanced.php
>
> /wp-admin/edit-form-comment.php
>
> /wp-admin/edit-link-form.php
>
> /wp-admin/edit-page-form.php
>
> /wp-admin/menu.php
>
> /wp-admin/menu-header.php
>
> /wp-admin/upgrade-functions.php
>
> /wp-admin/upgrade-schema.php
>
> /wp-admin/import/blogger.php
>
> /wp-admin/import/dotclear.php
>
> /wp-admin/import/livejournal.php
>
> /wp-admin/import/mt.php
>
> /wp-admin/import/rss.php
>
> /wp-admin/import/textpattern.php
>
> /wp-content/plugins/hello.php
>
> /wp-content/plugins/wp-db-backup.php
>
> /wp-content/plugins/akismet/akismet.php
>
> /wp-content/themes/classic/index.php
>
> /wp-content/themes/classic/comments.php
>
> /wp-content/themes/classic/comments-popup.php
>
> /wp-content/themes/classic/footer.php
>
> /wp-content/themes/classic/header.php
>
> /wp-content/themes/classic/sidebar.php
>
> /wp-content/themes/default/index.php
>
> /wp-content/themes/default/404.php
>
> /wp-content/themes/default/archive.php
>
> /wp-content/themes/default/archives.php
>
> /wp-content/themes/default/attachment.php
>
> /wp-content/themes/default/comments-popup.php
>
> /wp-content/themes/default/footer.php
>
> /wp-content/themes/default/functions.php
>
> /wp-content/themes/default/header.php
>
> /wp-content/themes/default/links.php
>
> /wp-content/themes/default/page.php
>
> /wp-content/themes/default/search.php
>
> /wp-content/themes/default/searchform.php
>
> /wp-content/themes/default/sidebar.php
>
> /wp-content/themes/default/single.php
>
> /wp-includes/default-filters.php
>
> /wp-includes/kses.php
>
> /wp-includes/locale.php
>
> /wp-includes/rss-functions.php
>
> /wp-includes/template-loader.php
>
> /wp-includes/vars.php
>
> /wp-includes/wp-db.php
>
>
> NO CRITICAL :-)