bugtraq - Re: WordPress Search Function SQL-Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070227222332.16523.qmail@securityfocus.com>
Date: 27 Feb 2007 22:23:32 -0000
From: kelson@...ox.com
To: bugtraq@...urityfocus.com
Subject: Re: WordPress Search Function SQL-Injection

This looks like the bug described here: http://trac.wordpress.org/ticket/3722
"DB error when sanitized search string results in empty query" (Filed January 31)

According to that page:
> I guess it's also worth mentioning that commas
> _are_ being sanitized. The reason for the error is
> that once the commas are gone WordPress attempts 
> to wrap the search query with "AND ( $search )"
> 
> Since $search is null MySQL throws up an error.

The same error results from searching for just a space.  In either case, adding other characters to the field results in the expected query.  It doesn't look like injection would be possible.