[wp-hackers] Wordpress database encryption.

[Dion Hulse (dd32)]

On 27 November 2011 17:02, Mike Schinkel <mikeschinkel at newclarity.net> wrote:
> On Nov 27, 2011, at 12:37 AM, jackie sparks wrote:
>> Miscoded and rouge plugins, I'm talking about plugins that allow SQL injections. Not plugins that actually look like they have bad intent.
>
> I'm confused. Isn't SQL injection mostly destructive, and not for accessing information? Doesn't matter if a table's data is encrypted dropping a table still drops a table.
>
> Of course I don't consider myself a security expert so maybe I'm wrong about this and it is reasonable to use SQL injection to access data?

SQL Injection can be used for anything; Adding users, Deleting users,
Droping tables, and in many cases, Has also been used to alter the
SELECT query to display different data than expected, For example, if
you could SQL inject the primary WP_Query SQL, you could make the
posts list display usernames/emails/hashed passwords instead of posts.
In many cases, the SQL Injections in plugins can't be used to show
data, only alter the data going into the database, which only allows
DROP/INSERT/UPDATE attacks to be usable by that attack vector.