Last day we got following query on our database:
SELECT `modRedirect`.`id` AS `modRedirect_id`, `modRedirect`.`pattern` AS `modRedirect_pattern`, `modRedirect`.`target` AS `modRedirect_target`, `modRedirect`.`context_key` AS `modRedirect_context_key`,
`modRedirect`.`triggered` AS `modRedirect_triggered`, `modRedirect`.`triggered_first` AS `modRedirect_triggered_first`, `modRedirect`.`triggered_last` AS `modRedirect_triggered_last`,
`modRedirect`.`active` AS `modRedirect_active`
FROM `modx_redirects` AS `modRedirect`
WHERE ((`modRedirect`.`pattern` = 'if(now()=sysdate(), sleep(5), 0)/*'XOR(if(now()=sysdate(), sleep(5), 0))OR'"XOR(if(now()=sysdate(), sleep(5),
0))OR"*//fotogalerija-cilj-polmaratonske-preizkusnje-21.-ljubljanskega-maratona.html') AND (`modRedirect`.`context_key` = 'web' OR `modRedirect`.`context_key` IS NULL OR `modRedirect`.`context_key`
= '') AND `modRedirect`.`active` = 1)
because it looks very strange, I look in apache log and found:
69.141.184.19 - - [06/Nov/2016:20:13:02 +0100] "GET /fotogalerije/fotogalerija-polmaratonska-in-maratonska-preizkusnja-mgdD6mye'));select%20pg_sleep(21);%20--%20.-ljubljanskega-maratona.html HTTP/1.1" 200 160 "
http://www.planet.si:80/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36"
Probably this query is not caused by exactly this request, but access log is full of such attempts.
AFAIK query just lock redirect table and manager stop working.
Is there already a fix for this SQL injection?
We have a version 2.3.2.
☆ A M B ☆