Hello,
There is a sql injection in WordPress 2.1.2 (and maybe others) .
A user with "add link" permission (Editor/Administrator) can do this :
The '$new_cat' variable in "wp_set_link_cats()" function is not checked
properly before be used in the sql query :
File /wp-admin/admin-db.php, Line 472 :
$wpdb->query("
INSERT INTO $wpdb->link2cat (link_id, category_id)
VALUES ($link_ID, $new_cat)");
- Omid
