Bugtraq mailing list archives
Re: WordPress 2.0.3 SQL Error and Full Path Disclosure
From: Jaroslaw Sajko <sloik () parareal net>
Date: Tue, 04 Jul 2006 20:18:37 +0200
Dnia 02-07-2006, nie o godzinie 09:15 +0000, xzerox () linuxmail org napisaĆ(a):
Example: http://localhost/wordpress/index.php?paged=-1 Result: WordPress database error: [Erreur de syntaxe pr?s de '-20, 10' ? la ligne 1] SELECT DISTINCT * FROM wp_posts WHERE 1=1 AND post_date_gmt <= '2006-06-29 12:46:59' AND (post_status = "publish") AND post_status != "attachment" GROUP BY wp_posts.ID ORDER BY post_date DESC LIMIT -20, 10
Put this line somewhere in the wp-settings.php file (for example at the end of the code before the do_action(init) call): $wpdb->hide_errors();
~ Full path ~ /wp-settings.php /wp-admin/admin-footer.php /wp-admin/admin-functions.php /wp-admin/edit-form.php
in line 60 of wp-settings.php change to: error_reporting(0); Now the World is safe. -- js
Current thread:
- WordPress 2.0.3 SQL Error and Full Path Disclosure xzerox (Jul 03)
- Re: WordPress 2.0.3 SQL Error and Full Path Disclosure James Davis (Jul 04)
- Re: WordPress 2.0.3 SQL Error and Full Path Disclosure Jaroslaw Sajko (Jul 04)
- <Possible follow-ups>
- Re: WordPress 2.0.3 SQL Error and Full Path Disclosure zck zck (Jul 12)
- RE: WordPress 2.0.3 SQL Error and Full Path Disclosure Aaron Newman (Jul 13)
- Re: WordPress 2.0.3 SQL Error and Full Path Disclosure nate (Jul 15)
- RE: WordPress 2.0.3 SQL Error and Full Path Disclosure Aaron Newman (Jul 13)
- Re: WordPress 2.0.3 SQL Error and Full Path Disclosure jholguin (Jul 15)