{"id":6513463,"date":"2015-09-05T08:34:17","date_gmt":"2015-09-05T08:34:17","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/sql-injection-vulnerability-9\/"},"modified":"2016-08-30T17:39:10","modified_gmt":"2016-08-30T17:39:10","slug":"sql-injection-vulnerability-9","status":"closed","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/sql-injection-vulnerability-9\/","title":{"rendered":"SQL Injection Vulnerability"},"content":{"rendered":"

So, you have this query here:<\/p>\n

$tablerows = $wpdb->get_results( "SELECT <code>login_id<\/code>, <code>login_ip<\/code>,<code>login_attempts<\/code>,<code>attempt_time<\/code>,<code>locked_time<\/code> FROM  <code>$tablename<\/code>   WHERE <code>login_ip<\/code> =  '$ip'  ORDER BY <code>login_id<\/code> DESC LIMIT 1 " );<\/code><\/pre>\n
The variable $ip is populated by this function<\/p>\n
function getip(){\n                   if (!empty($_SERVER['HTTP_CLIENT_IP'])) {\n                    $ip = $_SERVER['HTTP_CLIENT_IP'];\n                } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {\n                    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];\n                } else {\n                    $ip = $_SERVER['REMOTE_ADDR'];\n                     if($ip=='::1'){\n                         $ip = '127.0.0.1';\n                     }\n                }\n                return $ip;\n            }<\/code><\/pre>\n
So if someone sends an X-Forwarded-For HTTP header with a malicious SQL injection payload, they could overwrite your query and hack your database.<\/p>\n
https:\/\/wordpress.org\/plugins\/wp-limit-login-attempts\/<\/p>\n","protected":false},"template":"","class_list":["post-6513463","topic","type-topic","status-closed","hentry","topic-tag-sql","topic-tag-sql-injection","topic-tag-sqli"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/6513463","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/6513463\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=6513463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}