I stumbled upon a case where several database entries were updated. And the update is rather unusual.

For example if I have an entry named:


The updated version is:

Watermelon<IMG SRC="/WF_SQL_XSRF.html">

The WF_SQL_XSRF.html file is not in the server, nor it was from internal people. I did google and only a single Korean forum mentioned this and said "Watch your security." But I didn't find a single relevant documentation about this WF_SQL_XSRF thing. I know that the word XSRF is not a good sign already, but I just want to know what tool this might come from and is it common to have one.

I also find several other unattended website that has this line:


References: http://www.erel.kr/bbs/board.php?bo_table=study&wr_id=247&sfl=mb_id%2C1&stx=admin&page=2


2 Answers 2


This doesn't look like a SQL Injection attack to me. A SQL injection attack would contain SQL keywords like select, update, delete, drop, etc.

But, it does look like user input is not being sanitized properly before being written to the database, and this could open the door to other types of attacks such as XSS attacks.

So, you might want to take this as a sign that a security checkup might be in order. In addition to looking into how your application sanitizes and/or escapes user input before writing it to the database - you might also want to be sure that all content originating from external sources is written to DOM elements using .innerText() (not .innerHTML). This way, if the content contains any dangerous tags (such as <script> tags), these will not be executed. You might also want to implement a restrictive content security policy (CSP) as another measure to mitigate these types of attacks.

  • Thank you for the answer. As I pointed out, it was an updated entry that I noticed rather than a query. But I did check the log and so far didn't find anything related to SQL Injection. So can I assume that it's fine if it's <img src> tag?
    – spitfire
    Jul 28, 2021 at 3:56
  • I think you still should be concerned about how this got in your database, especially if the content gets written back to web pages. Next time, it could be <script>/* Bad stuff here... */</script>. See security.stackexchange.com/questions/65142/… for more info.
    – mti2935
    Jul 28, 2021 at 10:33

WF_SQL_XSRF.html is the payload of an HCL AppScan Standard link injection test. AppScan appends the payload to parameters and then submits the request. It is possible the parameters are processed all the way through to the database.

  • 1
    Can you cite a source for this info?
    – schroeder
    Aug 3, 2022 at 8:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .