2

Hacker is trying to attack the site by using the following SQL injection query to get the SQL version.

Using URL site. example:

www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),CONCAT(0x71787a7171,(SELECT (ELT(9701=9701,1))),0x71767a6271,FLOOR(RAND(0)*2))X FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY X)a)

In my application, I am using prepared statmenets that queryParamString as a clear text into DB without any side effects.

My question:

  • Is there any best practices to sanitize the URL when PHP server receives a request to render the page.
  • Or any client-side practices?
  • Any pointers on how to prevent or how you would deal with this kind of attack
  • Define "Sanitize and insert". Are you using prepared queries? – Conor Mancone Jan 9 at 22:05
  • 1
    yes, updated the question – user2936008 Jan 9 at 22:08
  • Is the attack successful? If you use prepared statements, it should not be! – Anders Jan 10 at 10:35
  • nope as I mentioned in question select query inserted as clear text into db. – user2936008 Jan 10 at 17:46
2

Best practice, server and client-side: always, always sanitise your inputs, outputs, and use prepared statements.

You could look at using a WAF (web application firewall) which will detect attempted SQL attacks etc and offer a layer of protection and also customise responses if they are detected. Other than stopping an attacker via something like IP blacklisting, if you have an Internet-facing service then there will be malicious actors trying to attack. To prevent this, you need secure, well-written code, such as prepared statements.

| improve this answer | |
  • thank you. Definitely WAF is a helpfull prevention mechanism. Thank you for suggestion – user2936008 Jan 10 at 18:58
1

Based on the query string, that is sqlmap, not scanning for a vulnerability, but extracting data, suggesting that there either is a vulnerability or it's a false positive. However it is using error based extraction, which is not very prone to false positives.

I suggest you investigate this further. Although you may be using parameterized queries (which is the best way to avoid sql injection) it is possible that there is a missed parameter in the code leaving a vulnerability open.

| improve this answer | |
  • thank you, yeah we are using parameterized queries – user2936008 Jan 10 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.