This question already has an answer here:
- What is SQL injection? 2 answers
Our webserver is forwarding HTTP GET request to application server as below including a statement or condition like "AND 1=1", our Palo Alto Firewall detecting this traffic as SQL Injection alert.
PCAP is like below
Hypertext Transfer Protocol GET /cadocs/0/j027931e.pdf?resultnum=9&intcmp=searchresultclick AND 1=1 HTTP/1.0\r\n [Expert Info (Chat/Sequence): GET /cadocs/0/j027931e.pdf resultnum=9&intcmp=searchresultclick AND 1=1 HTTP/1.0\r\n]
Can you please explain me is webserver sending this "AND 1=1" in requests is bad practice how it can help attackers? What kind of modifications can be done from webserver or application server side to resolve this?
Thank You for your efforts...