cbwV AND 2890=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(115)||CHR(111)||CHR(115)||CHR(113)||(SELECT (CASE WHEN (2890

Is just one of the terms, there are 10+ different ones cropping up, and being used every day. Are these something to be worried about? Is there a way to find out what the IP address is that has performed the search?

cbwV%' AND (SELECT 7520 FROM(SELECT COUNT(*),CONCAT(0x71736f7371,(SELECT (CASE WHEN (7520=7520) THEN 1 ELSE 0 END)),0x7168707371

Is another. There are a lot of these, all different. If this is an attempted exploit, can someone point me in the direction of any docs/patch notes for this specific attack?


1 Answer 1


This is regular a kind of "attack", but you should not worry about. If you are using the default Magento search module, the inputs are sanitized and nothing will happen to your site.

In the other hand, if you are using a custom search module you should check how it is implemented to be sure it is safe.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.