Test wordpress sites for SQL Injection on siteurl

Posted by Scott B on Stack Overflow See other posts from Stack Overflow or by Scott B
Published on 2010-04-08T19:34:58Z Indexed on 2010/04/08 19:43 UTC
Read the original article Hit count: 341

Filed under:

php

|

Wordpress

|

security

I have a client who's wordpress sites have gotten hacked twice by iframe scammers. Each time they've injected iframe code into the content of the sites.

This last time, today, they simply changed the siteurl in wp_options to their iframe code. The result was obvious and appeared to simply botch the paths of the scripts that rely on

I can't determine if its a password compromise (on FTP or WordPress itself) or a SQL injection to alter siteurl. Since the only thing that was altered is siteurl, I'm thinking perhaps SQL Injection.

What are your thoughts? Any way to scan a site for potential SQL injection vulnerabilities?

The only active plugins on the site are contact form 7 and google xml sitemaps.

© Stack Overflow or respective owner

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More

Related posts about Wordpress

Add Your Own Domain to Your WordPress.com Blog

as seen on How to geek - Search for 'How to geek'
Now that you’ve got a nice blog on WordPress.com, why not get your own domain to brand your site? Here’s how you can easily register a new domain or move your existing domain to your WordPress site. By default, your free WordPress address is yourblog’sname.wordpress.com. But whether this… >>> More
Moving from wordpress.com to self-hosted wordpress blog

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello, I have been writing articles on the wordpress.com blog, now i am looking to move it to self-hosted wordpress blog but i wonder: 1) Should i move all my articles on the new blog or just put an article on my last blog that more articles will be posted on my new blog?* 2) If i move all articles… >>> More
Include WordPress Content Outside of WordPress

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm looking to build a mobile version of a WordPress site and have most of it built in static files, but am trying to get access to the WordPress content from inside an external PHP file that the mobile site will run from. How can I get access to the loop or database without manually writing SQL queries… >>> More
What is the difference between theme making process using Wordpress Theme and Wordpress Theme Framew

as seen on Stack Overflow - Search for 'Stack Overflow'
What is the difference between "Wordpress Theme" and Wordpress Theme Frameworks? In terms of technicalities, Custom theme making workflow, File and folder structure, Anatomy. Wordpress default theme Vs Wordpress theme's framework's Child theme >>> More
Integration of WordPress With WordPress bbPress

as seen on Ezine Articles - Search for 'Ezine Articles'
bbPress is a powerful and fully featured forum software that can be integrated with blogging tools like WordPress. A first glance at the software, gives the impression that it is simple and devoid of any complicated structure, but one has to use it in order, to believe that it is a very powerful tool. >>> More