Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 400835 (CVE-2011-4899) - www-apps/wordpress PHP Execution and XSS via setup-config.php page (CVE-2011-4899)
Summary: www-apps/wordpress PHP Execution and XSS via setup-config.php page (CVE-2011-...
Alias: CVE-2011-4899
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B3 [noglsa]
Depends on:
Reported: 2012-01-25 21:26 UTC by Michael Harrison
Modified: 2016-02-29 14:13 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Michael Harrison 2012-01-25 21:26:36 UTC
The WordPress 'setup-config.php' installation page allows users to install
WordPress in local or remote MySQL databases. This typically requires a user
to have valid MySQL credentials to complete.  However, a malicious user can
host their own MySQL database server and can successfully complete the
WordPress installation without having valid credentials on the target system.

After the successful installation of WordPress, a malicious user can inject
malicious PHP code via the WordPress Themes editor.  In addition, with control
of the database store, malicious Javascript can be injected into the content
of WordPress yielding persistent Cross Site Scripting.

POC and Original Reference:

Solution Per Vendor:
No official fix for these issues will be released for the WordPress
publishing platform. However, administrators can mitigate these issues by
creating strong MySQL passwords and defining rules within a web application
firewall (WAF) solution.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2012-11-11 13:47:01 UTC
CVE-2011-4899 (
  ** DISPUTED ** wp-admin/setup-config.php in the installation component in
  WordPress 3.3.1 and earlier does not ensure that the specified MySQL
  database service is appropriate, which allows remote attackers to configure
  an arbitrary database via the dbhost and dbname parameters, and subsequently
  conduct static code injection and cross-site scripting (XSS) attacks via (1)
  an HTTP request or (2) a MySQL query.  NOTE: the vendor disputes the
  significance of this issue; however, remote code execution makes the issue
  important in many realistic environments.
Comment 2 Samuel Damashek (RETIRED) gentoo-dev 2013-12-22 19:21:50 UTC
There's no plan for upstream to release a fix for this issue. What's the view of others on the validity of this bug?
Comment 3 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-02-21 04:35:51 UTC
The vulnerability is disputed and no signs of fixing it from wordpress source/repos.  Package has always been masked due to their constant security vulnerabilities which typically are ignored.  GLSA?
Comment 4 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-02-29 14:13:43 UTC
CVE states only wordpress-3.3.1 and earlier.  No vulnerable ebuilds in tree.  CVE is disputed as mentioned.