CVE:CVE-2012-5328
CNNVD:CNNVD-201210-091
WordPress是WordPress软件基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。
WordPress中的Mingle Forum插件1.0.33之前的1.0.32.1版本中存在多个SQL注入漏洞。远程认证攻击者可利用这些漏洞通过removemember操作中的(1)memberid或(2)groupid参数或(3)fs-admin/fs-admin.php中的id参数或(4)fs-admin/wpf-edit-forum-group.php脚本中edit_save_forum操作中的edit_forum_id参数，执行任意SQL命令。
solution:Upgrade cartpauj mingle-forum to a higher version than 1.0.32.1,1.0.00,1.0.01,1.0.02,1.0.03,1.0.04,1.0.05,1.0.06,1.0.07,1.0.08,1.0.09,1.0.10,1.0.11,1.0.12,1.0.13,1.0.14,1.0.15,1.0.16,1.0.17,1.0.18,1.0.19,1.0.20,1.0.21,1.0.21.1,1.0.22,1.0.23,1.0.23.1,1.0.23.2,1.0.24,1.0.25,1.0.26,1.0.27,1.0.28,1.0.28.1,1.0.28.2,1.0.29,1.0.30,1.0.31,1.0.31.1,1.0.31.2,1.0.31.3,1.0.31.4,1.0.32,and avoid the version (,1.0.32.1],1.0.00,1.0.01,1.0.02,1.0.03,1.0.04,1.0.05,1.0.06,1.0.07,1.0.08,1.0.09,1.0.10,1.0.11,1.0.12,1.0.13,1.0.14,1.0.15,1.0.16,1.0.17,1.0.18,1.0.19,1.0.20,1.0.21,1.0.21.1,1.0.22,1.0.23,1.0.23.1,1.0.23.2,1.0.24,1.0.25,1.0.26,1.0.27,1.0.28,1.0.28.1,1.0.28.2,1.0.29,1.0.30,1.0.31,1.0.31.1,1.0.31.2,1.0.31.3,1.0.31.4,1.0.32