Free share all

san

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrgOmag5CIap_aTVpuQ6E36Tg2jfTf8f1buTUv6_6lPZ8bOKO_XZOUjafO0VtcvJMP92sYPSGMelfpRSBg5K3G-mIxHKpdl89nGE0Q4JZzY-iX3pIs2B-CundP0TN1vFZLhNUlvUigOs1W/s1600/wordpress-seo-by-yoast.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="101" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrgOmag5CIap_aTVpuQ6E36Tg2jfTf8f1buTUv6_6lPZ8bOKO_XZOUjafO0VtcvJMP92sYPSGMelfpRSBg5K3G-mIxHKpdl89nGE0Q4JZzY-iX3pIs2B-CundP0TN1vFZLhNUlvUigOs1W/s1600/wordpress-seo-by-yoast.jpg" width="320" /></a></div>
 
 
A critical vulnerability has been discovered in the most popular plugin 
of the wordpress content management platform (CMS) that puts tens of 
Millions of websites at risks of being hacked by the attackers. 
 
The vulnerability actually resides in most versions of a WordPress plugin known as ‘WordPress SEO by Yoast,’
 which has more than 14 Million downloads according to Yoast website, 
making it one of the most popular plugins of WordPress for easily 
optimizing websites for search engines i.e Search engine optimization 
(SEO). 
 
The vulnerability in WordPress SEO by Yoast has been discovered by Ryan Dewhurst, developer of the WordPress vulnerability scanner ‘WPScan’. 
 
All the versions prior to 1.7.3.3 of ‘WordPress SEO by Yoast’ are vulnerable to Blind SQL Injection web application flaw, according to an advisory published today. 
 
SQL injection (SQLi) vulnerabilities are ranked as critical one because 
it could cause a database breach and lead to confidential information 
leakage. Basically in SQLi attack, an attacker inserts a malformed SQL 
query into an application via client-side input. 
 
HOW YOAST VULNERABILITY WORKS 
 
However, in this scenario, an outside hacker can’t trigger this vulnerability itself because the flaw actually resides in the 'admin/class-bulk-editor-list-table.php' file, which is authorized to be accessed by WordPress Admin, Editor or Author privileged users only. 
Therefore, in order to successfully exploit this vulnerability, it is 
required to trigger the exploit from authorized users only. This can be 
achieved with the help of social engineering, where an attacker can 
trick authorized user to click on a specially crafted payload 
exploitable URL. 
If the authorized WordPress user falls victim to the attack, this could 
allow the exploit to execute arbitrary SQL queries on the victim 
WordPress web site, Ryan explained to security blogger Graham Cluley. 
Ryan also released a proof-of-concept payload of Blind SQL Injection vulnerability in ‘WordPress SEO by Yoast’, which is as follows: 
 
http://victim-wordpress-website.com/wp-admin/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date%2c(select%20*%20from%20(select(sleep(10)))a)&order=asc 
 
PATCH FOR YOAST SQLi VULNERABILITY 
 
However, the vulnerability has reportedly been patched in the <a class="externalLink" href="https://wordpress.org/plugins/wordpress-seo/" rel="nofollow" target="_blank">latest version of WordPress SEO by Yoast (1.7.4)</a> by Yoast WordPress plugin developers, and change log mentions that latest version has "fixed possible CSRF and blind SQL injection vulnerabilities in bulk editor." 
 
Generally, it has been believed that if you have not installed WordPress
 Yoast for SEO, then your WordPress website is seriously incomplete. The
 vulnerability is really serious for website owners who wish to increase
 their search engine traffic by using this plugin. 
 
Therefore, WordPress administrators with disabled Auto-update feature 
are recommended to upgrade their WordPress SEO by Yoast plugin as soon 
as possible or they can manually download the latest version from 
WordPress plugin repository. 
 
If you have installed WordPress 3.7 version and above, then you can 
enable fully automate updating of your plugins and themes from Manage > Plugins & Themes > Auto Updates tab. 
 
Nguồn: thehackernews.com 
<div data-redactor-wrapper="1" style="left: -9999px; position: absolute;">
<div data-redactor="1">
A critical vulnerability has been discovered in the most popular plugin 
of the wordpress content management platform (CMS) that puts tens of 
Millions of websites at risks of being hacked by the attackers.</div>
<div data-redactor="1">

</div>
<div data-redactor="1">
The vulnerability actually resides in most versions of a WordPress plugin known as ‘WordPress SEO by Yoast,’
 which has more than 14 Million downloads according to Yoast website, 
making it one of the most popular plugins of WordPress for easily 
optimizing websites for search engines i.e Search engine optimization 
(SEO).</div>
<div data-redactor="1">

</div>
<div data-redactor="1">
The vulnerability in WordPress SEO by Yoast has been discovered by Ryan Dewhurst, developer of the WordPress vulnerability scanner ‘WPScan’.</div>
<div data-redactor="1">

</div>
<div data-redactor="1">
All the versions prior to 1.7.3.3 of ‘WordPress SEO by Yoast’ are vulnerable to Blind SQL Injection web application flaw, according to an advisory published today. </div>
<div data-redactor="1">

</div>
<div data-redactor="1">
SQL injection (SQLi) vulnerabilities are ranked as critical one because 
it could cause a database breach and lead to confidential information 
leakage. Basically in SQLi attack, an attacker inserts a malformed SQL 
query into an application via client-side input.</div>
<div data-redactor="1">

</div>
<div data-redactor="1">
HOW YOAST VULNERABILITY WORKS </div>
<div data-redactor="1">
However, in this scenario, an outside hacker can’t trigger this vulnerability itself because the flaw actually resides in the 'admin/class-bulk-editor-list-table.php' file, which is authorized to be accessed by WordPress Admin, Editor or Author privileged users only.</div>
<div data-redactor="1">

</div>
<div data-redactor="1">
Therefore, in order to successfully exploit this vulnerability, it is 
required to trigger the exploit from authorized users only. This can be 
achieved with the help of social engineering, where an attacker can 
trick authorized user to click on a specially crafted payload 
exploitable URL.</div>
<div data-redactor="1">

</div>
<div data-redactor="1">
If the authorized WordPress user falls victim to the attack, this could 
allow the exploit to execute arbitrary SQL queries on the victim 
WordPress web site, Ryan explained to security blogger Graham Cluley.</div>
<div data-redactor="1">

</div>
<div data-redactor="1">
Ryan also released a proof-of-concept payload of Blind SQL Injection vulnerability in ‘WordPress SEO by Yoast’, which is as follows:</div>
http://victim-wordpress-website.com/wp-admin/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date%2c(select%20*%20from%20(select(sleep(10)))a)&order=asc
<div data-redactor="1">
PATCH FOR YOAST SQLi VULNERABILITY </div>
<div data-redactor="1">
However, the vulnerability has reportedly been patched in the <a href="https://wordpress.org/plugins/wordpress-seo/">latest version of WordPress SEO by Yoast (1.7.4)</a> by Yoast WordPress plugin developers, and change log mentions that latest version has "fixed possible CSRF and blind SQL injection vulnerabilities in bulk editor."</div>
<div data-redactor="1">

</div>
<div data-redactor="1">
Generally, it has been believed that if you have not installed WordPress
 Yoast for SEO, then your WordPress website is seriously incomplete. The
 vulnerability is really serious for website owners who wish to increase
 their search engine traffic by using this plugin.</div>
<div data-redactor="1">

</div>
<div data-redactor="1">
Therefore, WordPress administrators with disabled Auto-update feature 
are recommended to upgrade their WordPress SEO by Yoast plugin as soon 
as possible or they can manually download the latest version from 
WordPress plugin repository. 
 
If you have installed WordPress 3.7 version and above, then you can 
enable fully automate updating of your plugins and themes from Manage > Plugins & Themes > Auto Updates tab.</div>
</div>
<div data-redactor-wrapper="1" style="left: -9999px; position: absolute;">
<div data-redactor="1">
A critical vulnerability has been discovered in the most popular plugin 
of the wordpress content management platform (CMS) that puts tens of 
Millions of websites at risks of being hacked by the attackers.</div>
<div data-redactor="1">