Bad news for just about every WordPress blogger out there. Thousands of WordPress 3.2.1 installations are at risk of being compromised. It has been found that the latest version 3.2.1 of WordPress, an extremely popular suite of tools for powering blogs, is vulnerable to XSS injection attack which allows users to inject malicious JavaScript as a result of failure in sanitizing the comments field. Without discussing much about what this vulnerability could do to your blog I will jump to how it works and the solution.
How does it work?
Inject one of the below codes into the comment field of the target. Or use your brain to make a more powerful injection
Popup “alert” Box
Redirect to www.hungry-hackers.com
Cookie Stealer (need a logging system in place)
Solution:
Upgrade to the latest version when available, In the meantime disable comments or hold comments for moderation as I did
No comments:
Post a Comment