I've recently seen a few strange requests made on our site, I'm wondering what they might be.

Normally we get sql injection attempts like this:


While I'm no expert, I loosely understand the gist of what's happening there.

But recently I've started noticing ones like this:


I've never seen anything like that before. I googled it and it seems to related to Apache struts, but I didn't fully understand most of the results (see shot below).

I'm not too sure about the tags for this question - if they can be improved, please do so. Thanks.

enter image description here

  • Are these lines taken from server logs? – user56893 May 12 '15 at 21:13
  • No, I've set up a warning system that alerts me if any fishy form or querystring data is posted – Martin Hansen Lennox May 12 '15 at 21:26

It looks like someone is trying exploit an SQL injection vulnerability in struts2 in order to perform remote code execution. See http://struts.apache.org/docs/s2-016.html

Not the answer you're looking for? Browse other questions tagged or ask your own question.