Wordpress: Iframe injection attack

RawAlex · 12-31-2007

This isn't 0-day or anything like that, but within the last few days I have had a number of posts over different blogs have an iframe added DIRECTLY INTO THE POST data, which connected to a chinese site that appears to be installing toolbars and back doors.

Go to your blog database, and do the following query:

SELECT * FROM `wp_posts` WHERE post_content like "%
If you get anything, check them closely. It is either an ip address or the domain wp-stats-php.info.

This is a serious issue, at least one of the sites I found it on has tumbled to the very bottom of google results from page 1 on good keyword pairs.

12-31-2007	#1
RawAlex Members $100 for every ImLive sign-up Join Date: Oct 2002 Posts: 4,036	Wordpress: Iframe injection attack This isn't 0-day or anything like that, but within the last few days I have had a number of posts over different blogs have an iframe added DIRECTLY INTO THE POST data, which connected to a chinese site that appears to be installing toolbars and back doors. Go to your blog database, and do the following query: SELECT * FROM `wp_posts` WHERE post_content like "% If you get anything, check them closely. It is either an ip address or the domain wp-stats-php.info. This is a serious issue, at least one of the sites I found it on has tumbled to the very bottom of google results from page 1 on good keyword pairs. __________________ Let's go to the edge of disaster Push the pedal and go a little faster Let's slam into a wall at ramming speed Let's go to the edge of a mountain Jump off and lets start countin' Hit the ground and tell me if it bleeds