0

Don't know why but the PCI scan do not pass Category URL of Magento and provide a SQL injection with 'mode' param in the below format.

/main-category/sub-category/l/price:10-20/category-name.html?dir=desc&mode=x'%2Bsleep(15)%2B'&order=name HTTP/1.0

How should I resolve this type of issue? Do anybody have gone through it, if yes please provide your kind suggestions.

Thanks in Advance

1 Answer 1

1

Are you using nginx or apache?

In nginx, you can do the following, in your server { } block;

if ($arg_order ~* .+(select|create|insert|update|drop|delete|concat|alter|load|sleep)) {
   return 403;
}

For apache in .htaccess;

RewriteEngine on

RewriteCond %{QUERY_STRING} ^.*(;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark|sleep).* [NC,OR]
4
  • Added apache rule, but your Magento module used for filtering may have an SQL vulnerability. Please post what module you're using for that. Jun 4, 2018 at 11:23
  • How could I test that the above solution is working ? Jun 5, 2018 at 7:25
  • @amit_game try accessing the url that failed in your pci scan, of your original Q. Jun 5, 2018 at 8:52
  • I tried It. its providing access to the result , what I want that if a url have a specious function like sleep, it stop navigation or redirect to 404 page Jun 5, 2018 at 9:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.