Answered Evo - Possible SQL Injection?

Quote from: BobRay at Jan 23, 2016, 02:15 PM

The message appears to be reporting a vulnerability, not an intrusion.

Quote from: sottwell at Jan 23, 2016, 11:19 PM

The attempt would then be filtered internally with the MODX processing code. The attempt would simply fail.

I'm going to agree with Bob & Susan and amplify Susan's answer a bit...

First off, it's not possible to review the code invoked by the second URL the OP provided, because (as mentioned in the original post), the URL was changed before posting. The first URL and parameter the scanner reported, however, can be checked.

In the case of the first (login.processor.php), Susan is completely correct that MODX Evo "filters / escapes / sanitizes" the username parameter before it's used anywhere in the code, to avoid SQL injection. Here's the line that does that: https://github.com/modxcms/evolution/blob/v1.0.15/manager/processors/login.processor.php#L58 in the PHP referenced by the scanner.

The HTTP 406 response the scanner expects for this test attack, in my observation, comes when a web server module such as mod_security is installed. The module would look for SQL injection (and other) attack patterns in each request before passing the request on to the underlying application code (MODX, in this case), and if it finds one, return the 406 "unacceptable" return without ever touching the application being tested. If such a module isn't installed on the OP's server, then the MODX code would get the request, but filter the parameter - silently, as Susan said.

That's not to say that the application itself couldn't / shouldn't return a 406 on its own, but in at least the case of the first thing the scanner found, MODX is following one of the practices to avoid SQL injection. I suspect that there's not a real SQL injection risk there.