A friend of mine works for a company which owns a 15-ish years old website written in PHP using Apache/MySQL/home brew CMS and outdated hosting on OS Debian 8 "jessie". SSH allows passwords (with no fail2ban or similar) plus both their "admin" page and phpMyAdmin are exposed, accessible and they do not use rate-limiter or any other brute-force preventing techniques or software. Oh, yes, and website is vulnerable to SQL injections too. So, all together it is a security disaster. On the top of that, as I learned from Apache logs, they got some attention from malicious users and, obviously, it is just a matter of time when they gonna be hacked.
Due to the recent COVID-19 issues their company is trying to keep a business going and didn't layoff anyone, but they don't have a budget to re-write a website (yet). Their goal is to survive thru those tough times, mitigate as many issues as possible without touching PHP code and later re-write a website. That's why solutions from here, here or here are not gonna work for them.
So, he asked me about some temporary ideas/solutions which they can use next 6-9 months and I suggested to:
- Hide their admin page by renaming it from "admin.php" to a random name like "002cff74-84fd-4451-8014-a0d4ea669426.php"
- Move to a cloud VPS
- it is cheaper than their current hosting
- it has a newer OS with security patches
- they can control SSH, phpMyAdmin and use fail2ban and/or other software if needed
However, SQL injections are still on the list and I'm not familiar with Apache/PHP to give more advices - I use both nginx/nodejs and IIS/.NET.
Here is my question: What would be the best way to temporary mitigate SQL injections without changing an application code?
Should I suggest to use .htaccess to filter queries? Should he use a proxy to do the same? Is there any other relatively inexpensive way to do that? Any help appreciated.