Core

Cryptocurrency

Bitcoin

Security

The Cyber Security Agency of Singapore&nbsp;(CSA) highlighted that a cryptocurrency widget plugin for the web development platform WordPress contains a vulnerability that can be used to extract sensitive information.&nbsp;
A security bulletin <a href="https://www.csa.gov.sg/alerts-advisories/security-bulletins/2024/sb-2024-006" target="_blank" rel="noopener nofollow">released</a> by the Singapore Cyber Emergency Response Team (SingCERT) alerted against the plugin named “The Cryptocurrency Widgets – Price Ticker &amp; Coins List,” marking it down for critical vulnerabilities. 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-02/6a2a3413-e32f-4f39-9c1c-b6da5a960961.png" alt="" title="">
 <figcaption style="text-align: center;">
 SingCERT’s Security Bulletin summarizes the list of vulnerabilities in the WordPress crypto widget. Source:&nbsp;csa.gov.sg
 </figcaption>
</figure>
As shown above, the crypto widget received a 9.8/10 base score, placing it at “critical,” which is the highest on the spectrum of vulnerabilities. 
The National Vulnerability Database (NVD) — the United States government repository of standards-based vulnerability management data — <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-0709" target="_blank" rel="noopener nofollow">explained</a> that the WordPress crypto plugin is “vulnerable to SQL Injection via the ‘coinslist’ parameter in versions 2.0 to 2.6.5 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.”
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-02/ea65e13f-ca9f-4fb5-a4a1-5189a64c1123.png" alt="" title="">
 <figcaption style="text-align: center;">
 WordPress widget “Cryptocurrency Widgets – Price Ticker &amp; Coins List plugin” security risk. Source:&nbsp;nvd.nist.gov
 </figcaption>
</figure>
The said vulnerability allows the extraction of sensitive information from the database by making it possible for unauthenticated attackers to append additional structured query language (SQL) queries into already existing queries.
<a href="https://www.cve.org/CVERecord?id=CVE-2024-0709" target="_blank" rel="noopener nofollow">According</a> to the security firm CVE Program, the widget was provided by a vendor named “narinder-singh,” and versions 2.0 through 2.6.5 were found to carry the vulnerability. 
Related: <a href="https://cointelegraph.com/news/bitcoin-atm-vulnerability-ethical-hackers">Bitcoin ATM flaw could’ve given hackers ‘total control’</a>
On Dec. 9, 2023, the NVD flagged Bitcoin (<a href="https://cointelegraph.com/bitcoin-price">BTC</a>) inscriptions as a cybersecurity risk. 
According to the database records, a data carrier&nbsp;<a href="https://cointelegraph.com/news/bitcoin-inscriptions-national-vulnerability-database">limit can be bypassed by masking data</a> as code in some Bitcoin Core and Bitcoin Knots versions. “As exploited in the wild by Inscriptions in 2022 and 2023,” reads the document.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-02/dda8eb82-1c22-4a79-bd81-e719cf7b7204.png" alt="" title="">
 <figcaption style="text-align: center;">
 Bitcoin’s vulnerability is listed in the Common Vulnerabilities and Exposures (CVE) System. Source: CVE Records
 </figcaption>
</figure>
The NVD’s website features a recent X post from Bitcoin Core developer Luke Dashjr as an information resource. Dashjr alleges that inscriptions exploit a Bitcoin Core vulnerability to spam the network. “I guess it’s like receiving junk mail that you have to sift through every day to find the ones that are your contacts. It slows down the process,” a user wrote in the discussion.
Magazine:&nbsp;<a href="https://cointelegraph.com/magazine/real-life-doge-18-meme-going-to-the-moon/">Real-life Doge at 18: Meme that’s going to the moon</a>

This WordPress crypto widget plugin can leak sensitive information

Cointelegraph

2024년 2월 8일에 게재된 다른 기사

Ethereum Crypto: Can ETH Price Jump Above The Supply Zone?

SUI And Filecoin (FIL) Entice Investors At Current Prices, While Rebel Satoshi Presale Remains Pr...

Cardano Price Prediction: Will ADA Price Hit $1 in 2024?

Gary Gensler: The Man Behind SEC

Bitcoin Analyst Says Altcoins To Drive Crypto Market Valuation To $2.2 Trillion: Sui (SUI), Celes...

Robert Kiyosaki: Rich Dad Author’s Dire Warning on Banks Failure, Bitcoin an Only Option?

무료 뉴스레터에 가입하여 매일 최신 암호화폐 소식을 받아보세요!