WordPress Core 0.6/0.7 - 'Blog.header.php' SQL Injection

Author: Seth Woolley
type: webapps
platform: php
port: 
date_added: 2003-10-03 
date_updated: 2012-12-08 
verified: 1 
codes: OSVDB-4609 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/8756/info

Wordpress has been reported prone to multiple SQL injection vulnerabilities. The issues have been reported to exist in the blog.header.php script. A lack of sufficient sanitization performed on 'cat' and 'order_by' URI parameters, may allow an attacker to inject malicious SQL code and thereby influence legitimate Wordpress SQL queries.

Ultimately an attacker may exploit this vulnerability to insert SQL code into Wordpress requests and have the SQL code executed by the underlying database server.

http://www.example.com/index.php?cat=100)%09or%090=0%09or%09(0=1