2

I recently faced a problem where, I am receiving emails from an unknown source. Somehow they bypass the validation for email and sending me SQL statement in email fields for example: (SELECT CHAR(113)+CHAR(113)+CHAR(118)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (8513=8513) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(98)+CHAR(113))

That's what I am receiving on my email that, I set on Magento contacts configuration. When I tried to find out the exact issue, I found out that If I save the HTML of contact page and remove all the validation from there, then I can able to submit the form from my local system. I am receiving email even if I submit the form, that I saved on my local system.

I also tried other forms to check for the same, but other forms have validation on the server side too, but only contact form having this issue.

How can we solve this issue?

8
  • have you did customize form page? Commented Mar 21, 2018 at 13:01
  • I only added a ReCaptcha on the contact page. Commented Mar 21, 2018 at 13:06
  • I think you have to Setup Google Recaptcha Developed by Magecomp, It is free Extension you can try it. magecomp.com/magento-new-recaptcha.html Commented Mar 21, 2018 at 13:32
  • did you use an extension to add recaptcha, or is this default magento captcha? Commented Mar 21, 2018 at 13:41
  • I used an extension to implement the recaptcha. Commented Mar 21, 2018 at 18:31

1 Answer 1

0

You have to add a captcha check on the server side. On the contact page, at the bottom of the form, you should already have something like:

<div class="g-recaptcha" data-callback="myrecaptchaCallback" data-sitekey="MYDATASITEKEY"></div>

Now if you want to prevent a hacker to save you contact page as HTML and modify it to bypass Javascript validation, you must add a server side validation on the file which is the value of the action field in your form. You should already have something like:

<form name="contact" onsubmit="return validateForm()" method="post" 
action="processcontact.php">

All you have to do is add a captcha verification in processcontact.php. The minimum is to check the presence of the captcha:

<?php
captcha;
if(isset($_POST['g-recaptcha-response'])){
$captcha=$_POST['g-recaptcha-response'];
}
if(!$captcha){
echo '<h2>Please check the captcha.</h2>';
exit;
}
?>

Source: https://codeforgeek.com/2014/12/google-recaptcha-tutorial/

Hope this helps,

Alexandre

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.