SQL injection using URL query string (web application/php server)

Question

Hacker is trying to attack the site by using the following SQL injection query to get the SQL version.

Using URL site. example:

www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),CONCAT(0x71787a7171,(SELECT (ELT(9701=9701,1))),0x71767a6271,FLOOR(RAND(0)*2))X FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY X)a)

In my application, I am using prepared statmenets that queryParamString as a clear text into DB without any side effects.

My question:

• Is there any best practices to sanitize the URL when PHP server receives a request to render the page.
• Or any client-side practices?
• Any pointers on how to prevent or how you would deal with this kind of attack

Answer 1

Best practice, server and client-side: always, always sanitise your inputs, outputs, and use prepared statements.

You could look at using a WAF (web application firewall) which will detect attempted SQL attacks etc and offer a layer of protection and also customise responses if they are detected. Other than stopping an attacker via something like IP blacklisting, if you have an Internet-facing service then there will be malicious actors trying to attack. To prevent this, you need secure, well-written code, such as prepared statements.

Answer 2

Based on the query string, that is sqlmap, not scanning for a vulnerability, but extracting data, suggesting that there either is a vulnerability or it's a false positive. However it is using error based extraction, which is not very prone to false positives.

I suggest you investigate this further. Although you may be using parameterized queries (which is the best way to avoid sql injection) it is possible that there is a missed parameter in the code leaving a vulnerability open.