WordPress scenario introduction
In this scenario, we have a typical internet-facing web application based on a well-known CMS: WordPress. To make a real-world scenario, we looked at some WordPress plugins and found some interesting vulnerabilities.
We chose a niche plugin called wp-shoutbox-live-chat [2], version 1.4.2, which generates a shoutbox on the site. It reminded us of the early years of the web when it was a rarity to write while being able to interact synchronously with other site users (and all before the advent of WebSocket).
It’s an interesting case study on SQL injection, how to find it through source code analysis, and how to approach this vulnerability in applications that use a specific framework.
As we delved deeper into the plugin, we encountered another vulnerability – XSS. While not the primary focus of this chapter, we’ve decided to include it as a spoiler ahead ofthe more in-depth explanation in Chapter 6.
At the time of writing...
