WordPress 2.0.3 SQL Error and Full Path Disclosure=0D
Discovered By zero [Moroccan Security Team]=0D
Software: WordPress 2.0.3=0D
Site : www.wordpress.org=0D 
=0D
~ SQL Error ~=0D
=0D
Example:=0D
=0D
http://localhost/wordpress/index.php?paged=-1=0D 
=0D
Result:=0D
=0D
WordPress database error: [Erreur de syntaxe pr?s de '-20, 10' ? la ligne 1]=0D
SELECT DISTINCT * FROM wp_posts WHERE 1=1 AND post_date_gmt <= '2006-06-29 12:46:59' AND (post_status = "publish") AND post_status != "attachment" GROUP BY wp_posts.ID ORDER BY post_date DESC LIMIT -20, 10=0D
=0D
=0D
~ Full path ~=0D
=0D
/wp-settings.php=0D
/wp-admin/admin-footer.php=0D
/wp-admin/admin-functions.php=0D
/wp-admin/edit-form.php=0D
/wp-admin/edit-form-advanced.php=0D
/wp-admin/edit-form-comment.php=0D
/wp-admin/edit-link-form.php=0D
/wp-admin/edit-page-form.php=0D
/wp-admin/menu.php=0D
/wp-admin/menu-header.php=0D
/wp-admin/upgrade-functions.php=0D
/wp-admin/upgrade-schema.php=0D
/wp-admin/import/blogger.php=0D
/wp-admin/import/dotclear.php=0D
/wp-admin/import/livejournal.php=0D
/wp-admin/import/mt.php=0D
/wp-admin/import/rss.php=0D
/wp-admin/import/textpattern.php=0D
/wp-content/plugins/hello.php=0D
/wp-content/plugins/wp-db-backup.php=0D
/wp-content/plugins/akismet/akismet.php=0D
/wp-content/themes/classic/index.php=0D
/wp-content/themes/classic/comments.php=0D
/wp-content/themes/classic/comments-popup.php=0D
/wp-content/themes/classic/footer.php=0D
/wp-content/themes/classic/header.php=0D
/wp-content/themes/classic/sidebar.php=0D
/wp-content/themes/default/index.php=0D
/wp-content/themes/default/404.php=0D
/wp-content/themes/default/archive.php=0D
/wp-content/themes/default/archives.php=0D
/wp-content/themes/default/attachment.php=0D
/wp-content/themes/default/comments-popup.php=0D
/wp-content/themes/default/footer.php=0D
/wp-content/themes/default/functions.php=0D
/wp-content/themes/default/header.php=0D
/wp-content/themes/default/links.php=0D
/wp-content/themes/default/page.php=0D
/wp-content/themes/default/search.php=0D
/wp-content/themes/default/searchform.php=0D
/wp-content/themes/default/sidebar.php=0D
/wp-content/themes/default/single.php=0D
/wp-includes/default-filters.php=0D
/wp-includes/kses.php=0D
/wp-includes/locale.php=0D
/wp-includes/rss-functions.php=0D
/wp-includes/template-loader.php=0D
/wp-includes/vars.php=0D
/wp-includes/wp-db.php=0D
=0D
=0D
Greetz:=0D
=0D
simo64, tahati, net_ghost, dabdoub, simo dreaminfo, iss4m, zerosecure, hunter, themenotor ...=0D
=0D
Contact:=0D
=0D
Author: Mourad [ zero ]=0D
Email : xzerox(at)linuxmail(dot)org