Strange Looking Search Terms - Possible Malicious activity?

Question

cbwV AND 2890=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(115)||CHR(111)||CHR(115)||CHR(113)||(SELECT (CASE WHEN (2890

Is just one of the terms, there are 10+ different ones cropping up, and being used every day. Are these something to be worried about? Is there a way to find out what the IP address is that has performed the search?

cbwV%' AND (SELECT 7520 FROM(SELECT COUNT(*),CONCAT(0x71736f7371,(SELECT (CASE WHEN (7520=7520) THEN 1 ELSE 0 END)),0x7168707371

Is another. There are a lot of these, all different. If this is an attempted exploit, can someone point me in the direction of any docs/patch notes for this specific attack?

Regards

Answer 1

This is regular a kind of "attack", but you should not worry about. If you are using the default Magento search module, the inputs are sanitized and nothing will happen to your site.

In the other hand, if you are using a custom search module you should check how it is implemented to be sure it is safe.