Undisclosed Wordpress 2.0 Security Issues

I recently came across this security advisory and decided to find out what the undisclosed issues could be. I downloaded wordpress 2.0 to find these undisclosed issues. Why I am interested in Wordpress 2.0 is a different story though. :)

It was trivial to figure out that this version has no protection against CSRF attacks. The file wp-admin/options-reading.php has a parameter posts_per_rss that seems to have been left unsanitized. It is possible to make an admin submit (via CSRF) a malicious value of this parameter which will eventually result in a database error. However, the injection seems really difficult to exploit.

Example: http://192.168.1.183:80/apache2-default/wordpress/?feed=rss2

WordPress database error: [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1]

SELECT DISTINCT * FROM wp_posts WHERE 1=1 AND post_date_gmt <= '2007-01-08 04:12:59' AND (post_status = "publish") AND post_status != "attachment" GROUP BY wp_posts.ID ORDER BY post_date DESC LIMIT 0, 10'

As the injection point is after Limit and because of the Order By clause, I think it is not exploitable.

If you think it is indeed exploitable, drop me an email now...