Saturday, November 2, 2024
HomeCVE/vulnerabilityHackers Launching Website Take Over Attack by Exploiting Multiple Zero-day Vulnerabilities -...

Hackers Launching Website Take Over Attack by Exploiting Multiple Zero-day Vulnerabilities – 150,000 + Websites Affected

Published on

Malware protection

Researchers uncovered a new site take over the campaign that targeting WordPress websites by exploiting the multiple WordPress Plugin Zeroday vulnerabilities.

3 popular WordPress plug-ins are exploited as a part of this ongoing site take over attack campaign.

This campaign mainly targeting the WordPress websites and exploiting the multiple XSS vulnerabilities in the above vulnerable plugs to inject the malicious javascript.

- Advertisement - SIEM as a Service

Cross-site scripting (XSS) vulnerability let an attacker inject untrusted snippets of JavaScript into your application without validation. This JavaScript is then executed by the victim who is visiting the target site.

In results, Attackers create a rogue administrator account to infect with a site with the backdoor for future attacks.

Plugin Zeroday Vulnerabilities

The same type of Unauthenticated Stored XSS Zero vulnerability recently patched in the Flexible Checkout Fields for WooCommerce plugin which allowed attackers to modify the plugin’s settings. 

Another Stored XSS vulnerability in one of the above Plugin Async JavaScript let attackers inject with a crafted payload to execute malicious JavaScript when a WordPress administrator views certain areas of their dashboard. 

Async Javascript plugin is currently installed on more than 100,000 WordPress sites and the Author Frank Goossens, quickly released a patch for this issue after the issues reported by Wordfence researchers.

Wordfence researchers reported 3rd unauthenticated Stored XSS in 10Web Map Builder for Google Maps, which has installed in 20,000 WordPress websites.

According to Wordfence report ” The vulnerability in 10Web Map Builder exists in the plugin’s setup process. The plugin’s setup functions are called during admin_init which, like Flexible Checkout Fields, is accessible to unauthenticated users. If an attacker injects malicious JavaScript into certain settings values, that code will execute for administrators in their dashboard as well as front-of-site visitors in some circumstances.”

10Web Map Builder for Google Maps urges users to update to version 1.0.64 as soon as possible.

Lastly, Multiple Subscriber+ Stored XSS vulnerabilities reported in Modern Events Calendar Lite which installed in 40, 000 websites.

Researchers observed that Modern Events Calendar Lite registers several AJAX actions for login in users that allowed low privileged users such as a subscriber to manipulate the data and they can be injected with various XSS payloads.

It depends on where the attacker injecting the code and this campaign currently targeting administrators to create rogue accounts for the attackers.

This vulnerability has been fixed now. Update to version 5.1.7 as soon as possible.

Also Read: WP Hardening – A Free WordPress Security Plugin to Perform Real-time Security Audit On Your WordPress Site

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to...

SMB Force-Authentication Vulnerability Impacts All OPA Versions For Windows

Open Policy Agent (OPA) recently patched a critical vulnerability that could have exposed NTLM...