Don't know why but the PCI scan do not pass Category URL of Magento and provide a SQL injection with 'mode' param in the below format.

/main-category/sub-category/l/price:10-20/category-name.html?dir=desc&mode=x'%2Bsleep(15)%2B'&order=name HTTP/1.0

How should I resolve this type of issue? Do anybody have gone through it, if yes please provide your kind suggestions.

Thanks in Advance


Are you using nginx or apache?

In nginx, you can do the following, in your server { } block;

if ($arg_order ~* .+(select|create|insert|update|drop|delete|concat|alter|load|sleep)) {
   return 403;

For apache in .htaccess;

RewriteEngine on

RewriteCond %{QUERY_STRING} ^.*(;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark|sleep).* [NC,OR]
  • Added apache rule, but your Magento module used for filtering may have an SQL vulnerability. Please post what module you're using for that. – Ricky Odin Matthews Jun 4 '18 at 11:23
  • How could I test that the above solution is working ? – amit_game Jun 5 '18 at 7:25
  • @amit_game try accessing the url that failed in your pci scan, of your original Q. – Ricky Odin Matthews Jun 5 '18 at 8:52
  • I tried It. its providing access to the result , what I want that if a url have a specious function like sleep, it stop navigation or redirect to 404 page – amit_game Jun 5 '18 at 9:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.