The WordPress 'setup-config.php' installation page allows users to install
WordPress in local or remote MySQL databases. This typically requires a user
to have valid MySQL credentials to complete. However, a malicious user can
host their own MySQL database server and can successfully complete the
WordPress installation without having valid credentials on the target system.
After the successful installation of WordPress, a malicious user can inject
malicious PHP code via the WordPress Themes editor. In addition, with control
of WordPress yielding persistent Cross Site Scripting.
POC and Original Reference:
Solution Per Vendor:
No official fix for these issues will be released for the WordPress
publishing platform. However, administrators can mitigate these issues by
creating strong MySQL passwords and defining rules within a web application
firewall (WAF) solution.
** DISPUTED ** wp-admin/setup-config.php in the installation component in
WordPress 3.3.1 and earlier does not ensure that the specified MySQL
database service is appropriate, which allows remote attackers to configure
an arbitrary database via the dbhost and dbname parameters, and subsequently
conduct static code injection and cross-site scripting (XSS) attacks via (1)
an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the
significance of this issue; however, remote code execution makes the issue
important in many realistic environments.
There's no plan for upstream to release a fix for this issue. What's the view of others on the validity of this bug?
The vulnerability is disputed and no signs of fixing it from wordpress source/repos. Package has always been masked due to their constant security vulnerabilities which typically are ignored. GLSA?
CVE states only wordpress-3.3.1 and earlier. No vulnerable ebuilds in tree. CVE is disputed as mentioned.