☆ A M B ☆
I have yesterday received a warning from a security scan telling that our website has a BlindSQL injection vulnerability. Please find details about the finding in the attached PDF.I can unfortunately not reproduce the issue, therefore I hope you can tell what is happening. Don’t look too much on the SQL code that has been sent to the website, but at how the input is used:
I am not sure if it is really a BlindSQL injection, however we need to verify this because IF it is possible to pass SQL commands to the database, an attacker might easily drop tables for example.
- What is GET parameter “c” and how is it used in ModX?
- How is it passed to the database? à IF the vulnerability exists, then it has to be here
I can unfortunately not help you with debugging (don’t know ModX good enough), but I can help you verifying code in case you find something – let me know!
URI
https://www.somesite.com/fr/news/product-blog/?c=fr%27%20%2B%20(SELECT%200%20FROM%20(SELECT%20SLEEP(28))qsqli_2222)%20%2B%20%27&page=2
www.somesite.com
Result
Mean response time: 565
Standard deviation: 594
Number of stddev from mean: 46.592854
This vulnerability was identified using time-based inference that compared the average response time of a page to its response time with an injected payload. This vulnerability is confirmed based on timing rather than the content of the response.
Payload
%27%20%2B%20(SELECT%200%20FROM%20(SELECT%20SLEEP(28))qsqli_2222)%20%2B%20%27
This question has been answered by ThaClown. See the first response.
☆ A M B ☆
[[+articles]] <ul class="paging_ul"> [[+paging]] </ul>
☆ A M B ☆
$search = rawurldecode($_SERVER['REQUEST_URI']);
$search = rawurldecode($_SERVER['REQUEST_URI']);
$search = preg_replace('#\(.*?\)+#', '', $search);