The WordPress 'setup-config.php' installation page allows users to install WordPress in local or remote MySQL databases. This typically requires a user to have valid MySQL credentials to complete. However, a malicious user can host their own MySQL database server and can successfully complete the WordPress installation without having valid credentials on the target system. After the successful installation of WordPress, a malicious user can inject malicious PHP code via the WordPress Themes editor. In addition, with control of the database store, malicious Javascript can be injected into the content of WordPress yielding persistent Cross Site Scripting. POC and Original Reference: https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt Solution Per Vendor: No official fix for these issues will be released for the WordPress publishing platform. However, administrators can mitigate these issues by creating strong MySQL passwords and defining rules within a web application firewall (WAF) solution.
CVE-2011-4899 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4899): ** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments.
There's no plan for upstream to release a fix for this issue. What's the view of others on the validity of this bug?
The vulnerability is disputed and no signs of fixing it from wordpress source/repos. Package has always been masked due to their constant security vulnerabilities which typically are ignored. GLSA?
CVE states only wordpress-3.3.1 and earlier. No vulnerable ebuilds in tree. CVE is disputed as mentioned.
