WordPress.org

Ready to get started?Download WordPress

Forums

WP-PostRatings
[resolved] Hack Attach and Vulnerability (2 posts)

  1. g008888
    Member
    Posted 5 months ago #

    Hi,

    Most likely there was a hack attach on my site through your plugin the day before yesterday. The hacker tried to mess up with the rating settings and etc.

    Some how he also changed the font into italics for the front page and posts.

    A friend of mined dug into this and found that there were similar issue happening before? Want to seek your input. Thanks a lot.

    Hey, I think I found the exploit. It's noted here: https://secunia.com/community/advisories/46328 There appears to be an SQL injection vulnerability in the wp-postratings plugin - I'll do my best to explain it. Basically, when you make a query against a MySQL database, it could look something like this: SELECT * FROM your_table WHERE id=1, meaning give me the information in the database from the item who's id number is 1. Often times, websites grab parameters from the URL to query against a database. For example, if you go to google and search "hacks", you'll wind up at: http://www.google.com/#q=hacks The q represents query. Instead of going to the home page and typing in hacks, you can alter the url to search for "SQL" by going directly to: http://www.google.com/#q=SQL The vulnerability known as SQL injection is when someone takes advantage of this to alter a query. Looking at the original query I showed you, SELECT * FROM your_table WHERE id=1, if I were to type in 1 OR 1==1, the query can be interepreted as SELECT * FROM your_table WHERE id=1 OR 1==1. Since 1 always equals 1, it's going to return all the tables. If the input is properly sanitized, the query should be SELECT * FROM your_table WHERE id="1 OR 1==1", where the input is seen as a single statement, as opposed to an expansion of the query. This is is the basis for SQL injection. This is commonly used to, for example, steal banking or other sensitive information. However, instead of trying to STEAL information, your attacker injected code. What I think happened was this. The WordPress plugin he exploited takes some voting input and expects a number or a name. The PHP and SQL statement to insert it into the database might look like this: $p = 'SOME INPUT'; $statement = INSERT $p INTO some_table Then, the input is rendered on your page, like so: <p>Here, we have the SOME INPUT</p> Though 'SOME INPUT' would typically represent a number. Instead of following the usual voting protocol, he edited his input to be HTML, like this: $p = '<i>SOME HTML HERE</i>' $statement = INSERT $p INTO some_table Then, when it gets displayed to your visitors, the HTML is rendered, when it should be escaped, which is two vulnerabilities - on the way in and on the way out. I dug through your HTML, it appears he didn't close an tag, which italicizes fonts. It appears other people were hacked in the same way using the same plugin, as shown here: http://wordpress.org/support/topic/entire-site-suddenly-in-italics-1?replies=38

    https://wordpress.org/plugins/wp-postratings/

  2. Lester Chan
    Member
    Plugin Author

    Posted 5 months ago #

    That has been fixed 3 years ago, unless you are running an outdated plugin. The current version does not have any exploit that I know off.

    Any SQL injection can happen to any plugin not just mine. They may choose to exploit other plugins to gain access and mess with the ratings.

Reply

You must log in to post.

About this Plugin

About this Topic

Tags

No tags yet.