#1807 - Possible SQL injection attempt not detected as SQL injection attempt by Composr
-
By PDStig
- Added
- 6 views
| Identifier | #1807 |
|---|---|
| Issue type | Major issue (breaks an entire feature) |
| Title | Possible SQL injection attempt not detected as SQL injection attempt by Composr |
| Status | Closed (no changes needed) |
| Handling member | Chris Graham |
| Addon | securitylogging |
| Description | I received the following error recently:
An error occurred at: http://lovinity.org/pg/reportcontent/index.php?content_type=member%27A%3D0&content_id=25&url=http%3A%3Aslash%3A%3Aslash%3Alovinity.org%3Aslash%3Apg%3Aslash%3Amembers%3Aslash%3Aview%3Aslash%3A25&redirect=http%3A%3Aslash%3A%3Aslash%3Alovinity.org%3Aslash%3Apg%3Aslash%3Amembers%3Aslash%3Aview%3Aslash%3A25 The full error details follow: A source code file is missing: hooks/systems/content_meta_aware/member'A=0 (sources/hooks/systems/content_meta_aware/member'A=0.php or an overridden equivalent to this path) (version: 9.0.16, PHP version: 5.4.36, URL: /pg/reportcontent/index.php?content_type=member'A=0&content_id=25&url=http::slash::slash:lovinity.org:slash:pg:slash:members:slash:view:slash:25&redirect=http::slash::slash:lovinity.org:slash:pg:slash:members:slash:view:slash:25)[html] An error has occurred A source code file is missing: hooks/systems/content_meta_aware/member'A=0 (sources/hooks/systems/content_meta_aware/member'A=0.php or an overridden equivalent to this path) (version: 9.0.16, PHP version: 5.4.36, URL: /pg/reportcontent/index.php?content_type=member'A=0&content_id=25&url=http::slash::slash:lovinity.org:slash:pg:slash:members:slash:view:slash:25&redirect=http::slash::slash:lovinity.org:slash:pg:slash:members:slash:view:slash:25) Notice specifically member'A=0 . This looks like an SQL injection attempt to me. However it was simply registered as a missing source file. |
| Steps to reproduce | |
| Additional information | This came from the Report Content addon. |
| Funded? | No |
The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".
Comments
If they had for example ".." in this parameter, we'd pick it up as a file-system attack, as this parameter is being used in a file-system context.