[Systems] Somosazucar.org blog victim to SQL injection?

[Sam P.]

Wait, why are you so sure this is SQL injection?

Have you noticed any other changes on your blog?  Has anybody been
changing/adding extensions to/updating your blog?

On Sat, Jul 4, 2015 at 2:58 PM Sebastian Silva <sebastian at fuentelibre.org>
wrote:

>  Hi,
> I noticed our blog today is prepending a string to every page:
>
>   siteid ) ) )
>  return update_site_option( $key, $value );
>
>
>  $value = sanitize_option( $key, $value );
>  wp_cache_set( $cache_key, $value, 'site-options');
>
>
>  $value = maybe_serialize($value);
>
>
>  $wpdb-
> I looked around and it looks like it's coming from
> wp-includes/functions.php
>
> Anybody found something like this before?
> The code looks like it's there to add stuff to the template, i'm guessing
> it's found something injected into the SQL database?
>
> Thanks for any hints
>
> --
> I+D SomosAzucar.Org
> "icarito" #somosazucar en Freenode IRC
> "Nadie libera a nadie, nadie se libera solo. Los seres humanos se liberan en comunión" - P. Freire
>
>  _______________________________________________
> Systems mailing list
> Systems at lists.sugarlabs.org
> http://lists.sugarlabs.org/listinfo/systems
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sugarlabs.org/private/systems/attachments/20150704/f6f9df80/attachment.html>