Attacks on the mc4wp_form

  • Resolved fotske

    (@fotske)


    6 years ago

    Hi,

    I have received some alerts from my security plugin for blocked attacks on the mc4wp_form:

    novembre 1, 2018 10:10 109.73.229.120 (Bulgaria) Blocked for XSS: Cross Site Scripting in POST body: _mc4wp_form_id=1166″ onMouseOver=–>”>’>'”<vvv002058v809190>
    novembre 1, 2018 10:10 109.73.229.120 (Bulgaria) Blocked for Directory Traversal in POST body: _mc4wp_form_id=/../../../../../../../../../../../../etc/passwd
    novembre 1, 2018 10:10 109.73.229.120 (Bulgaria) Blocked for XSS: Cross Site Scripting in POST body: _mc4wp_form_id=1166′ onMouseOver=–>”>’>'”<vvv002060v809190>
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for XSS: Cross Site Scripting in POST body: _mc4wp_honeypot=1″ onMouseOver=–>”>’>'”<vvv001818v809190>
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for XSS: Cross Site Scripting in POST body: _mc4wp_honeypot=1′ onMouseOver=–>”>’>'”<vvv001820v809190>
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for LFI: Local File Inclusion in POST body: _mc4wp_honeypot=/etc/passwd
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for XSS: Cross Site Scripting in query string: attachment_id=539′ onMouseOver=–>”>’>'”<vvv001804v809190>
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for XSS: Cross Site Scripting in query string: attachment_id=539″ onMouseOver=–>”>’>'”<vvv001802v809190>
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for SQL Injection in POST body: _mc4wp_form_element_id=mc4wp-form-1′ UNION SELECT 8, table_name, ‘vega’ FROM information_schema.taables WHERE taable_name lê
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for SQL Injection in POST body: _mc4wp_form_element_id=mc4wp-form-1′ UNION SELECT 8, table_name, ‘vega’ FROM information_schema.tables WHERE table_name likê

    What are those attacks and how can I avoid them?

    Could you also please increase the security of your plugin urgently because there seems to be security issues?

    Thank you very much in advance for your answer.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Contributor Harish Chouhan

    (@hchouhan)

    Hello,

    Thanks for reaching out to us.

    Please note our plugin is secure enough and used on a million websites. This is the first time we have heard of such an issue.

    Can you please let us know if you are using the latest version of our plugin?

    Thread Starter fotske

    (@fotske)

    Hi,

    Yes I use the latest version of the plugin.

    Those attacks (probably made by a bot) have been blocked by my security plugin but it means that bots are trying to take advantage of some “security flaws” of the mc4wp_form.

    FYI, here are the explanations of those attacks from my security plugin:

    1) Blocked for XSS: Cross Site Scripting in POST body

    This attempts to see if posting some JavaScript to the server results in the server directly echoing back the JavaScript or not. If it does, then an attacker can get a victim to post something, and have that script run on the victim’s browser.

    2) Blocked for Directory Traversal in POST body: _mc4wp_form_id=/../../../../../../../../../../../../etc/passwd

    If your form_id was reading a file, this would attempt to go back 12 directory folders and attempt to read the passwords file on a unix machine.

    3) Blocked for LFI: Local File Inclusion in POST body: _mc4wp_honeypot=/etc/passwd

    Similar to 2), but this uses an absolute path to attempt to read the passwords file.

    4) Blocked for SQL Injection in POST body: _mc4wp_form_element_id=mc4wp-form-1′ UNION SELECT 8, table_name, ‘vega’ FROM information_schema.taables

    This attack attempts to try to attach itself onto your query to find all other tables in your database.

    I would advise you to look into these matters and update the security of your plugin to avoid having attacks.

    Kind regards.

    Plugin Author Danny van Kooten

    (@dvankooten)

    Hi Fotske,

    These are definitely attack attempts and thus blocking them is fine, but in our case even if they were not blocked they would not have been successful.

    Our plugin is not vulnerable to the attacks listed here.

    Hope that clarifies. If not, let us know please.

    I have the same problem!

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Attacks on the mc4wp_form’ is closed to new replies.