Results 1 to 2 of 2

Thread: Mod_security and SQL Injection

  1. #1
    Registered Member ziceva's Avatar
    Join Date
    May 2010
    Location
    Bucuresti, Romania
    Posts
    7

    Default Mod_security and SQL Injection

    It seems like SQL Injection is still possible with mod_security installed ... simply by putting the SQL code in a comment like /*! code_here */ ... this is a version dependent comment so will be executed by mysql, but it's not checked by mod_security (because it is a comment ...)

    I tried matching /*! ... with no success ... I tried matching ! and got hits only if the exclamation mark is alone ... as soon as it comes with /*! it doesn't get a match ...

    Any ideas an this?

    Let me explain by example:

    The problem: ht tp://example.com/test.php?id=1/*! UNION SELECT whatever */ does not get blocked
    Solution 1 (let's block ! ..):
    ht tp://example.com/test.php! (get's blocked)
    ht tp://example.com/test.php/*! (does not get blocked)

  2. #2
    Registered Member ziceva's Avatar
    Join Date
    May 2010
    Location
    Bucuresti, Romania
    Posts
    7

    Default Re: Mod_security and SQL Injection

    Found the solution ... I created a separate rule for this case and it worked just fine ... previously I was trying to edit the existing rule ...

Similar Threads

  1. Replies: 9
    Last Post: 01-17-2013, 05:01 PM
  2. mod_security and SQL injection (false positive?)
    By upsforum in forum Security
    Replies: 1
    Last Post: 01-11-2013, 04:25 AM
  3. SQL Injection
    By nitaish in forum Security
    Replies: 3
    Last Post: 10-03-2008, 06:37 PM
  4. SQL Injection
    By nitaish in forum General Discussion
    Replies: 3
    Last Post: 10-03-2008, 06:37 PM
bargain