29 Jun 2022
WordPress Authenticated SQL Injection
29 Jun 2022
OWASP 2013-A1 OWASP 2017-A1 OWASP 2021-A3 PCI v3.2-6.5.1 OWASP PC-C3 CAPEC-66 CWE-89 HIPAA-164.306(a) & HIPAA-164.308(a) ISO27001-A.14.2.5 WASC-19 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H WSTG-INPV-05
An authenticated SQL injection is an injection attack of using wrong solutions for database abstraction library. Successful exploitation can have catastrophic effects on the whole WordPress ecosystem. Th WordPress versions before WordPress 2.3.0-4.7.5.
Impact
Depending on the back-end database configuration, its privilege setup and the operating system, a hacker can mount one or more of the following type of attacks :
- Reading, updating and deleting arbitrary data/tables from the database.
- Executing commands on the underlying operating system.
Mitigation / Precaution
Latest Articles
Email injection attack: Impact, example & prevention
March 24 2023
The 7 Best Veracode Alternatives in the Market Today
February 6 2023
Internal Penetration Testing: The Definitive Guide [2023]
January 19 2023
Popular in Injection
WordPress Authenticated SQL Injection
June 29 2022
SQL injection(SQLi)
May 4 2022
Union Query SQL Injection (SQLi)
July 4 2018
Stacked Queries SQL Injection (SQLi)
July 4 2018
Inline Queries SQL Injection (SQLi)
July 4 2018
Categories
Client Side URL Redirect Cookies Attributes IBM SQL injection injection Time Based Blind SQL Injection SSL Injection CRLF Content Security Policy CSRF HSTS CORS Information Leakage status code SRI metadata X-XSS-Protection owasp XSS Clickjacking Cookies Directory traversal DOM XSS Blind SQL Injection SQL Injection XML Injection blog TLS WordPress web security SMB Cyber attacks AI Web server Wordpress Data Security DOMECTF2020 Container security CMS Security Code Execution Content security policy Htaccess Bypass DOMECTF2021 Press Webinar RFI DevSecOps Web Security Cyber Attacks DOMECTF2022 openssl HTTP headers Compliance AppSec
Related Articles
