1

In Magento's admin panel, I can see that a visitor of my magento website entered the following search query in the webshop's search bar:

productName" and (4=4 xor 6=9)-- a

where productName was originally the name of a product we sell.

I know what and and xor are for (though usually (in frontend usage) it only works when entered fully capitalized, I believe), but otherwise I don't understand what the visitor was trying to do here.

I am wondering if this is a hacking attempt. Is this a possibility? If yes, what was this person trying to achieve, and how can I prevent such attempts in the future?

1

I think someone is looking for SQL injection vulnerabilities.
he is looking to see if you sanitize your input variables.
Let's say that your search query would look like this:

'SELECT * FROM tbl WHERE name like "%'.$_GET['q'].'%"

This is wrong (and don't worry, magento does not do it this way).
Entering in search what he did productName" and (4=4 xor 6=9)-- a you endup with

'SELECT * FROM tbl WHERE name like "%productName" and (4=4 xor 6=9)-- a%"'

so and (4=4 xor 6=9) will be evaluated by the db engine and what's after -- will be considered comment.

The fact that you see this search text logged in the search tables means that magento does a good job in handling these potential sql injection attempts, so you are on the safe side.

You don't need to worry on one side, but you may want to look who is testing your website for vulnerabilities.

  • Thanks for the clarification. I don't fully understand it though, what would the 4=4 and 6=9 be for, and why would the hacker want to add a comment? (p.s. I now see that about 10 similar attempts were made as well) – paddotk Mar 24 '15 at 14:13
  • 4=4 returns true, 6=9 returns false. he was trying to see if both statements are interpreted by Mysql. also the comment line -- is to comment out the rest of the query in case you had other where statements. See a nice explanation here. – Marius Mar 24 '15 at 14:27
  • Great, many thanks. SQL is a bit out of my league but I understand it now :) – paddotk Mar 24 '15 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.