Zero-Day Attacks on Critical WooCommerce Bug Threaten Databases

guest · Jul 15, 2021

Zero-Day Attacks on Critical WooCommerce Bug Threaten Databases
The popular e-commerce platform for WordPress has started deploying emergency patches
July 15, 2021
https://threatpost.com/zero-day-attacks-woocommerce-databases/167846/

A critical SQL-injection security vulnerability in the WooCommerce e-commerce platform and a related plugin has been under attack as a zero-day bug, researchers have disclosed.

The exploitation prompted WooCommerce to release an emergency patch for the issue late on Wednesday. The bug could allow unauthenticated cyberattackers to make off with scads of information from an online store’s database – anything from customer data and payment-card info to employee credentials.
WooCommerce, a popular open-source e-commerce platform for websites running on WordPress, is installed on more than 5 million websites globally.
Click to expand...

The bug (CVE pending) was originally reported by HackerOne security researcher Thomas DeVoss (dawgyg), who said via Twitter that he was able to pull together a working proof-of-concept exploit, but that he wouldn’t release details of the bug until after there’s been time for merchants to apply the patch.

So, technical details are scant apart from the fact that it allows SQL injection – a type of attack that allows a cyberattacker to interfere with the queries that an application makes to its database.
According to researchers at Wordfence, there is “extremely limited evidence of [exploitation] attempts and it is likely that such attempts were highly targeted.”
Click to expand...

Wordfence: Critical SQL Injection Vulnerability Patched in WooCommerce

On July 14, 2021, WooCommerce released an emergency patch for a SQL Injection vulnerability reported by a security researcher, Josh from DOS (Development Operations Security), based in Richmond Virginia. This vulnerability allowed unauthenticated attackers to access arbitrary data in an online store’s database.
Click to expand...

Log in or Sign up

Zero-Day Attacks on Critical WooCommerce Bug Threaten Databases

guest Guest

Log in or Sign up

Zero-Day Attacks on Critical WooCommerce Bug Threaten Databases

guest Guest

Useful Searches