Testing Wordpress sites for SQL Injection on a site

Question

I have a client that clicks on Wordpress sites with double hacked iframes. Each time they embed the iframe code in the content of the sites.

Last time, today, they just changed siteurl in wp_options to their iframe code. The result was obvious and seemed to just pave the way for scripts that rely on

<?php bloginfo(); ?> 

I can’t determine if his password is compromised (via FTP or WordPress itself) or SQL injection to change the site. Since the only thing that has been changed is siteurl, I think maybe SQL Injection.

What are your thoughts? Any way to crawl a site for potential SQL injection vulnerabilities?

The only active plugins on the site are the contact form 7 and google xml sitemaps.

Answer 1

It is extremely unlikely that SQL Injection 0-day was used in this attack. Wordpress is one of the most insecure PHP projects I've ever tested, and it won the pwnie award for being so insecure. Wordpress Hackers are a complete joke, they rejected one of my vulnerability reports because they couldn’t understand a simple flaw, they didn’t even bother to run my exploit code. (The bug has been fixed.)

Using FTP is an extremely bad idea. You pass simple text passwords and source code over open Internet to CLEAR TEXT, you must be absolutely insane. Use SFTP !!!! I know that there is a virus (I don’t remember the name ...) that spreads by sniffing network traffic looking for FTP passwords, then it logs in and modifies the .php and .html files it finds. Run antivirus on all computers with FTP access to the server, AVG will remove this virus.

I am sure that wordpress or one of your plugins has never been updated. Vulnerabilities in plugins are commonly used to hack web applications. Check all version numbers of all installed libraries / web applications.

If you want to test your site for SQL Injection, then move display_errors=On in php.ini and run the free Sitewatch * service or open source Wapiti . After fixing any vulnerabilities, re-run the check to make sure that your fixes are saved. Then run PhpSecInfo to block php installation. Be sure to remove all RED entries from the report.

* I am associated with this site / service.

Answer 2

Do not forget about the comments. I had problems registering users and then dropping code in the comments and in their profile. Check there.

Answer 3

I think the Trojan horse steals FTP passwords from the user's PC.

Regarding software for testing your application against SQL injection, there are many answers to SO already

Answer 4

Have you tried any free SQL injection scanners? Nessus does this, but it is no longer free, there are several free ones, I'm sorry, it can no longer help, did not look at the databases at the age, and when I did, it was just a cursory glance.

Answer 5

If the link is related here , you should use NTOSpider to attack your site.