{"id":796,"date":"2024-06-30T22:31:21","date_gmt":"2024-06-30T22:31:21","guid":{"rendered":"https:\/\/www.yellowfalconmedia.com\/blog\/2024\/06\/30\/critical-security-flaw-exposes-1-million-wordpress-sites-to-sql-injection-dark-reading\/"},"modified":"2024-06-30T22:31:21","modified_gmt":"2024-06-30T22:31:21","slug":"critical-security-flaw-exposes-1-million-wordpress-sites-to-sql-injection-dark-reading","status":"publish","type":"post","link":"https:\/\/www.yellowfalconmedia.com\/blog\/2024\/06\/30\/critical-security-flaw-exposes-1-million-wordpress-sites-to-sql-injection-dark-reading\/","title":{"rendered":"Critical Security Flaw Exposes 1 Million WordPress Sites to SQL Injection – Dark Reading"},"content":{"rendered":"

A researcher received a $5,500 bug bounty for discovering a vulnerability (CVE-2024-2879) in LayerSlider, a plug-in with more than a million active installations.
April 4, 2024
Attackers can exploit a critical SQL injection vulnerability found in a widely used <\/span>WordPress plug-in<\/a><\/span> to compromise more than 1 million sites and extract sensitive data such as password hashes from associated databases.<\/span>
A security researcher called <\/span>AmrAwad<\/a><\/span> (aka 1337_Wannabe) discovered the bug in the LayerSlider, a plug-in for creating animated Web content. The security flaw, tracked as <\/span>CVE-2024-2879<\/a><\/span>, has a rating of 9.8 out of 10 on the CVSS 3.0 vulnerability-severity scale, and is associated with the "ls_get_popup_markup" action in versions 7.9.11 and 7.10.0 of LayerSlider. The vulnerability is due to "insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query," according to Wordfence.<\/span>
"This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database," the company said.<\/span>
Wordfence awarded the researcher a bounty of $5,500 \u2014 the company's highest bounty to date \u2014 for the discovery, according to a <\/span>blog post<\/a><\/span> by Wordfence. AmrAwad's March 25 submission came as part of Wordfence's second Bug Bounty Extravaganza, and the company contacted the Kreatura Team, developers of the plug-in, the same day to notify them of the flaw. The team responded the next day and delivered a patch in version 7.10.1 of LayerSlider on March 27.<\/span>
The potential for exploitation of the vulnerability lies in the insecure implementation of the LayerSlider plug-in's slider popup markup query functionality, which has an "id" parameter, according to Wordfence.<\/span>
According to the firm, "if the 'id' parameter is not a number, it is passed without sanitization to the find() function in the LS_Sliders class," which "queries the sliders in a way that constructs a statement without the prepare() function." \u00a0<\/span>
Since that function would "parameterize and escape the SQL query for safe execution in WordPress, thereby providing protection against SQL injection attacks," its absence creates a vulnerable scenario, according to Wordfence.<\/span>
However, to exploit the flaw requires a "a time-based blind approach" on the part of attackers to extract database information, which is "an intricate, yet frequently successful method to obtain information from a database when exploiting <\/span>SQL Injection<\/a><\/span> vulnerabilities," according to Wordfence.<\/span>
"This means that they would need to use SQL CASE statements along with the SLEEP() command while observing the response time of each request to steal information from the database," the company explained.<\/span>
Vulnerable <\/span>WordPress sites<\/a><\/span> <\/span>are a popular target<\/a><\/span> for attackers given the content management system's widespread use across the Internet, and often <\/span>vulnerabilities exist in plug-ins<\/a><\/span> that independent developers create for adding functionality to sites using the platform.<\/span>
Indeed, at least <\/span>43% of websites on the entire Internet<\/a><\/span> use WordPress to power their sites, e-commerce applications, and communities. Further, the wealth of sensitive data such as user passwords and payment info often stored within their pages represents a significant opportunity for threat actors who seek to misuse it.<\/span>
Making "the WordPress ecosystem more secure … ultimately makes the entire web more secure," WordPress noted.<\/span>
Wordfence advised that WordPress users with LayerSlider installed on sites verify immediately that they are updated to the latest, patched version of the plug-in to ensure it isn't vulnerable to exploit.<\/span>
Elizabeth Montalbano, Contributing Writer<\/p>\n

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.<\/span><\/p>\n

You May Also Like
Black Hat USA – Aug 3-8 – The Premier Technical Cybersecurity Conference – Learn More
Black Hat Europe – December 9-12 – Learn More
SecTor – Canada’s IT Security Conference Oct 22-24 – Learn More
2024 InformationWeek US IT Salary Report
Elastic named a Leader in The Forrester Wave\u2122: Security Analytics Platforms, Q4 2022
2023 Global Threat Report
EMA: AI at your fingertips: How Elastic AI Assistant simplifies cybersecurity
The Foundation for Building Scalable Applications to Fuel Customer Satisfaction and Growth
Data Protection Essentials: Proactive PII Leak Prevention and Data Mapping for GDPR
How Cyber Threat Intelligence Empowers the C-Suite
EMA: AI at your fingertips: How Elastic AI Assistant simplifies cybersecurity
The Cloud Threat Landscape: Security learnings from analyzing 500+ cloud environments
The Future of Cloud Security: Attack Paths & Graph-based Technology
Black Hat USA – Aug 3-8 – The Premier Technical Cybersecurity Conference – Learn More
Black Hat Europe – December 9-12 – Learn More
SecTor – Canada’s IT Security Conference Oct 22-24 – Learn More
<\/span>Copyright \u00a9 2024 Informa PLC Informa UK Limited is a company registered in England and Wales with company number 1072954 whose registered office is 5 Howick Place, London, SW1P 1WG.<\/p>\n

source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

A researcher received a $5,500 bug bounty for discovering a vulnerability (CVE-2024-2879) in LayerSlider, a plug-in with more than a million active installations.April 4, 2024Attackers can exploit a critical SQL injection vulnerability found in a widely used WordPress plug-in to compromise more than 1 million sites and extract sensitive data…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-796","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts\/796","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/comments?post=796"}],"version-history":[{"count":0,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts\/796\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/media?parent=796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/categories?post=796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/tags?post=796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}