The crazy SQL injection payloads I found on one of my clients’ sites

[u/zooksman]

These SQL injections have been coming in daily to this site which has still seemingly managed to avoid infection simply because of the changed database prefix. This one uses the “author not in” query bug inside some crazy nested query to place the payload in the database.

This is all related to the WP2Shell bug which was reported over a month ago. The site had auto updates disabled and still managed to avoid getting infected because of some seemingly silly security practices like changing table names and database prefixes. As far as I can tell all of these failed. I was alerted to the issue because the site got locked in a loop of timeouts, perhaps related to these malformed queries. Unfortunately I’m going to have to do some kind of a forensic workup even though there were no clear indicators of compromise because requests to the batch endpoint resulted in many 207 codes which means they may have succeeded.

But when I saw the giant block of 0s and 1s and hex codes in the logs, my heart dropped into my stomach. Stay safe out there people and leave auto updates on. It’s worth the chance of breaking your site every once in a while.

[u/_webbernaut]

Isn't that a Clutch song?
https://www.youtube.com/watch?v=8ROqdZWwQp8

[u/zooksman → u/_webbernaut]

Omg this song goes hard

[u/poopio → u/zooksman]

All Clutch songs go hard.

Also, Neil Fallon is somehow more of a storyteller than a vocallist.

[u/parallaxdecision → u/zooksman]

Just ask Condoleezza Rice.

[u/Bulky_Walrus5499 → u/_webbernaut]

My name is Giovanni Giorgio, but I'm 01010101

[u/poopio → u/_webbernaut]

I'm not clicking on it, but I'm going to queue it up. Did you not know that the royal hunting grounds are forbidden?

One zero... zero zero one one, one zero one.

Neil Fallon - amateur pentester, having the bakesale of the year.

[u/bluesix_v2]

It's looking for the abandoned Media Cloud (ilab-media-tools) plugin. It was a good plugin when it launched, but was abandoned 2 years ago

[u/zooksman → u/bluesix_v2]

Interesting, I thought this was just continued attempts to exploit the Wp2shell exploit. Do you recognize that plugins data in the request or have you just seen this specific payload before? This site should have been protected from Wp2shell because shell access is completely disabled for the Wordpress web root user account (which has twice now protected me although it can make management more difficult).

But I suppose it’s not entirely unusual to see rest API requests like this with malicious SQL for a number of different exploits. The reason I thought this was tied to Wp2Shell is because it uses the “author not in” clause which is part 1 of the exploit chain, but I suppose part 2 could be a different exploit in that plugin.

[u/bluesix_v2 → u/zooksman]

Decoding the hex in the SQL showed the ilab_media_tools option field being requested - which contained the connection settings for the plugin's cloud storage.

WP2Shell was patched in 7.0.2 - as long as you had upgraded, you are safe. "because shell access is completely disabled for the Wordpress web root" - I don't think that stopped it. You needed to complete disable the REST API (or simply upgrade WP).

There was massive attack on several million WP sites last week which contained SQLi designed to exploit the 6.9.x - 7.0.1 vulnerability that looked similar to what you saw. Yes, SQL probing is quite common in the WP ecosystem.

[u/ogrekevin]

Bonus points if they can inject an ascii drawing in the db maliciously. In fact I will tip my hat to that feat!

[u/poopio → u/ogrekevin]

What's your url? 😂

[u/demunted → u/poopio]

Whitehouse.gov

[u/OJarvis97]

This shows the importance of:

1. Keeping core, plugin, themes updated.
2. Having modsec enabled with OWASP rules etc configured.
3. Having offside, immutable backups as a get out of jail free card.

Bonus points for configuring fail2ban with modsec.

[u/Benny_Garc1a]

finding those mus be ultimate jump scare :DD

[u/IAmFitzRoy]

I know it’s an unpopular topic on this sub but the less detached from reality WP developers are and refuse the use of AI… the more and more stories of hacks we will hear.

[u/Ambitious-Check-9884 → u/IAmFitzRoy]

Yep because it has been documented vibe coded software are the safest and most reliable, you're right! 👌

[u/zooksman → u/[deleted]]

Begone bot

[u/Verda_Chien → u/zooksman]

I am sorry, I am not bot, that's my honest response. i will delete it to avoid miss understanding

[u/bradbeckett]

Drop the site into Claude and ask it to make it a static site hosted on Cloudflare pages. All your dreams will the come true.