Showing posts with label vulnerability. Show all posts
Showing posts with label vulnerability. Show all posts
Thursday, March 16, 2017
SQL injection vulnerability in WooCommerce Wordfence
SQL injection vulnerability in WooCommerce Wordfence
Yesterday Matt Barry, researchers at Wordfence discovered a SQL injection vulnerability in WooCommerce version 2.3.5 and more established amid a code review of the plugin storehouse. WooCommerce is introduced on more than 1 million active WordPress websites.
Wordfence has quickly reached Woo about the issue and theyve been unimaginably responsive, discharging a fix early today with their arrival of WooCommerce version 2.3.6.
We emphatically recommend you instantly upgrade on the off chance that you have not as of now.
The particular issue is a SQL injection weakness in the administrator board. Inside the Tax Settings page of WooCommerce, the key of the "tax_rate_country" POST parameter is passed unescaped into a SQL insert articulation. For instance, a payload of tax_rate_country[(SELECT SLEEP(10))] would result in the MySQL server to rest for 10 seconds.
Since this helplessness requires either a Shop Manager or Admin client account, it would need to be consolidated with a XSS attack so as to be misused.
What to do: Upgrade promptly to version 2.3.6 of WooCommerce which contains the fix.
Thanks to the WooThemes team for instantly tending to the issue and pushing the fix inside a couple of HOURS of accepting the report.
If you dont mind make sure to tweet, FB or email as expected to help spread the saying to your kindred WordPress site admins.
Go to link for download
Wednesday, March 8, 2017
Akismet XSS Vulnerability Wordpress Security Update
Akismet XSS Vulnerability Wordpress Security Update
A scientist from Sucuri told us of a XSS vulnerability in the Akismet WordPress plugin. This bug influences all versions of the Akismet WordPress plugin since 2.5.0, however we have no confirmation that it has been misused in nature. A vulnerability in Akismet found a week ago and due to fact that Akismet is a standout amongst the most broadly utilized plugins for WordPress, we needed to draw it out into the open.
Akismet is a comment spam channel for WordPress and when all is said in done, it makes an awesome showing. The Akismet team reported on their web journal a week ago that a cross website scripting (XSS) vulnerability had been found in all versions of Akismet since 2.5.0.
The vulnerability permits an hacker to post a remark on a WordPress site which will execute javascript in the WordPress administrator console. This is a normal XSS vulnerability example and one of the assaults it empowers would permit an aggressor to take a WordPress heads treats and increase regulatory access to a WordPress site.
There is no proof that the vulnerability has been abused in nature. The Akismet and WordPress teams instantly took the accompanying activities:
- They released updates for every single influenced version of Akismet.
- The WordPress.org team issued an automatic upgrade of the Akismet plugin on influenced sites. In the event that you saw that your WordPress site was automatically moved up to the freshest version of Akismet, that is the reason.
- The Akismet team adjusted their API so that if a hacker did attempt to endeavor a helpless version of Akismet, their API would shut the assault by sifting through the remark the hacker attempted to post. This means when the vulnerability was found and the Akismet team rolled out this improvement, even defenseless versions of Akismet were no more exploitable.
Kudos to the Akismet team for reacting to this so quickly and completely. In case youre running Akismet, we prescribe you sign into your WordPress site and ensure that Akismet has been redesigned to the most up to date version.
To update, visit the Updates page of your WordPress dashboard and take after the instructions. In the event that you have to download the plugin compress document straightforwardly, links to all versions are accessible in the WordPress plugins directory.
Go to link for download
Subscribe to:
Posts (Atom)