Web 2 0 Directory Plugin For Wordpress
Monthly
Time-based blind SQL injection in the Web 2.0 Directory plugin for WordPress (all versions up to and including 2.10.12) lets an attacker inject SLEEP-style conditional payloads through the 'w2dc_level_filter' parameter of the directory-listing filter and infer database contents from response timing. Because the parameter is interpolated into the query in integer context without surrounding quotes, WordPress's built-in addslashes/magic_quotes escaping does not neutralise the payload. The primary open question is privilege: the reporter describes the flaw as reachable by unauthenticated attackers, while the supplied CVSS vector encodes PR:L and our assessment records PR:N, so authentication requirements are not definitively resolved from the available data; extraction is also slow and detectable because it relies on blind timing inference. No public exploit code has been identified at time of analysis, and the issue is prioritised as this_month rather than as an emergency.
Time-based blind SQL injection in the Web 2.0 Directory plugin for WordPress (all versions up to and including 2.10.12) lets an attacker inject SLEEP-style conditional payloads through the 'w2dc_level_filter' parameter of the directory-listing filter and infer database contents from response timing. Because the parameter is interpolated into the query in integer context without surrounding quotes, WordPress's built-in addslashes/magic_quotes escaping does not neutralise the payload. The primary open question is privilege: the reporter describes the flaw as reachable by unauthenticated attackers, while the supplied CVSS vector encodes PR:L and our assessment records PR:N, so authentication requirements are not definitively resolved from the available data; extraction is also slow and detectable because it relies on blind timing inference. No public exploit code has been identified at time of analysis, and the issue is prioritised as this_month rather than as an emergency.