CVE-2017-5611 : SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attack

SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.

Published 2017-01-30 04:59:01

Updated 2021-01-30 02:37:30

Source Debian GNU/Linux

View at NVD, CVE.org

Vulnerability category: Sql Injection

Threat overview for CVE-2017-5611

Top countries where our scanners detected CVE-2017-5611

Top open port discovered on systems with this issue 80

IPs affected by CVE-2017-5611 23

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2017-5611!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2017-5611

Probability of exploitation activity in the next 30 days: 0.32%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 66 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2017-5611

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-5611

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-5611

https://codex.wordpress.org/Version_4.7.2

Version 4.7.2 | WordPress.org
Release Notes;Vendor Advisory

CVEs referencing this url
https://wpvulndb.com/vulnerabilities/8730

WordPress 3.5-4.7.1 - WP_Query SQL Injection
Patch;Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html

Oracle Critical Patch Update Advisory - January 2021
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2017/01/28/5

oss-security - Re: CVE Request: Wordpress: 4.7.2 security release: unauthorized bypass, SQL injection, cross-site scripting issues
Mailing List;Patch;Third Party Advisory

CVEs referencing this url
https://github.com/WordPress/WordPress/commit/85384297a60900004e27e417eac56d24267054cb

Query: Ensure that queries work correctly with post type names with s… · WordPress/WordPress@8538429 · GitHub
Patch;Third Party Advisory
http://www.securitytracker.com/id/1037731

WordPress Bugs Let Remote Users Conduct Cross-Site Scripting and SQL Injection Attacks, Obtain Potentially Sensitive Information, and Gain Elevated Privileges - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/bid/95816

WordPress Prior to 4.7.2 Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.debian.org/security/2017/dsa-3779

Debian -- Security Information -- DSA-3779-1 wordpress
Third Party Advisory

CVEs referencing this url
https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/

News – WordPress 4.7.2 Security Release – WordPress.org
Patch;Vendor Advisory

CVEs referencing this url

Products affected by CVE-2017-5611