Test wordpress sites for SQL Injection on siteurl
- by Scott B
I have a client who's wordpress sites have gotten hacked twice by iframe scammers. Each time they've injected iframe code into the content of the sites.
This last time, today, they simply changed the siteurl in wp_options to their iframe code. The result was obvious and appeared to simply botch the paths of the scripts that rely on
I can't determine if its a password compromise (on FTP or WordPress itself) or a SQL injection to alter siteurl. Since the only thing that was altered is siteurl, I'm thinking perhaps SQL Injection.
What are your thoughts? Any way to scan a site for potential SQL injection vulnerabilities?
The only active plugins on the site are contact form 7 and google xml sitemaps.