Cryptocurrency

Plugin Decentralized Oracle

when

Security

A crypto widget plugin for the web content management system WordPress was named as a “critical cybersecurity risk” yesterday. 
A security bulletin <a href="https://www.csa.gov.sg/alerts-advisories/security-bulletins/2024/sb-2024-006">released by the Cyber Security Agency of Singapore</a> (CSA) noted that a plugin, called “The Cryptocurrency Widgets – Price Ticker &amp; Coins List” has been identified as a cybersecurity risk and could potentially be exploited to extract sensitive information. 
The crypto widget obtained a base score of 9.8/10, placing it in the “critical” group of vulnerabilities the CSA uses to refer to vulnerabilities with a minimum score of 9/10. 
<h2 id="the-crypto-widget-plugin-s-vulnerabilities">The Crypto Widget Plugin’s Vulnerabilities</h2> 
 The National Vulnerability Database (NVD), the U.S. government repository for standards-based vulnerability management data, said that the WordPress crypto plugin is <a href="https://security.berkeley.edu/education-awareness/how-protect-against-sql-injection-attacks">susceptible to SQL Injection</a> through the ‘coinslist’ parameter in versions 2.0 to 2.6.5. 
This vulnerability arose from insufficient escaping on the user-supplied parameter and inadequate preparation on the existing SQL query. It permitted the extraction of sensitive information from the database, enabling unauthenticated attackers to add additional structured language queries to the existing ones. 
According to the security firm CVE Program, the widget <a href="https://www.cve.org/CVERecord?id=CVE-2024-0709">was supplied by a vendor identified as “narinder-singh,”</a> and versions 2.0 through 2.6.5 were identified as containing the vulnerability. 
<h2 id="cybersecurity-risks-plaguing-crypto">Cybersecurity Risks Plaguing Crypto</h2> 
 Security vulnerabilities are becoming increasingly common in the crypto industry. Two weeks ago, Bitcoin ATM manufacturer <a href="https://cryptonews.com/news/bitcoin-atm-vulnerability-fixed-hackers-could-have-gained-full-control.htm">Lamassu Industries addressed a vulnerability</a> that, if exploited, could have provided hackers with “full control” over its Bitcoin ATMs. 
Gabriel Gonzalez, Director of Hardware Security at IOActive, reported that the exploited vulnerabilities could have allowed the hackers to empty all funds from the ATM and manipulate the note reader to display inaccurate deposit amounts. 
The vulnerability was discovered when a team of ethical hackers from the security firm IOActive attempted to compromise Lamassu’s Bitcoin ATMs in 2023. The researchers identified and exploited multiple vulnerabilities, ultimately gaining full control over the ATMs.

Crypto Widget WordPress Plugin Flagged as “Critical” Cybersecurity Risk

Table of Contents

Cryptonews.com

Other articles published on Feb 8, 2024

Bitcoin Halving Supply Shock May Be Significant This Time, Here’s Why

Critical Security Alert: WordPress Plugin Vulnerability Exposed

Bitcoin Exchange Binance Announces This Altcoin Will Support Network Upgrade!

Deribit Exchange Broadens Trading Horizon with Altcoin Options

Harga XRP Bersiap untuk Melesat ke Angkasa di Tengah Aksi Investor Whale

Solana, Meme Moguls, and Bitcoin lead ahead of bull run

Join our free newsletter for daily crypto updates!