Forum

rsmeade said:

Hi – just today I received notification that the WP firewall stopped a potential SQL Injection attack on a sermon ID of -1. How can I know if any damage was done (I don't see anything apparent). Is this something I can prevent in the future, or is it something in the backend of sermon browser that will need to be coded for? Looks like Russians who were trying to get or change passwords.
Thanks for any help or insight you can provide, and if you need additional info, I can send it to you (a little concerned about posting too much detail here in a public forum).
Thanks!

An SQL injection attack is a serious attack, with the potential for data loss and/or stealing email addresses (but not passwords). In your case, because the firewall appears to have stopped the attack, no damage should have been done.

Versions 0.43.5 and below have this vulnerability, so you should update to 0.43.6 immediately.

I'm sorry for the problem. It's the first time in three years that hackers have identified any security issues with Sermon Browser, and I'm afraid it's almost impossible to completely prevent these problems in a plugin the complexity of SermonBrowser.