1

I try to block catalog_search because in the search list appears only sql inyections, but I can't

in first time I disable mage_CatalogSearch in System/config/advanced but appears more entries.

after that I comment the call in frontend, the same result the sql inyection list ground,

I delete the Search forms in frontend for template, base and rv and nothing change.

I erase all search but some hours later appears more injections in the dashborad panel Last 5 search Terms

the most common are:

1+waitfor+delay+00%3A00%3A15+--modules.php%3Fname%3Dsaint%27A%3D0%3F><SCRIPT>alert(%27SAINT%27)<%2FSCRIPT>

the only change was when i limit to 1 char the search in system/config/catalog/catalog_search

and the list continue to grown with 1 char search terms.

Please i need help to control that, I don't understand how continue to appears the search terms with the module disabled and the forms erased, at the same time how prevent to not save this garbage in the db.

1 Answer 1

1

My guess is they're using the results URL directly. So calling http://domain.com/catalogsearch/result/?q=....

Now as far as I know SQL injections via the search form aren't effective. It's pretty secure so imo there is no real danger in added the search form back in. When they find out the 'attack' isn't effective they'll probably stop at some point.

You could rewrite all catalogsearch URLs to a 404 page from the htaccess.

RewriteCond %{REQUEST_URI} ^/catalogsearch/$
RewriteRule ^(.*)$ /errors/404.php [L]
4
  • well yes, the attack are not effective, but consume bandwich and magento save this garbage in de database, and that will be dangerous. in the time. I not use the catalog search in the website. for that I search a way to erase de catalog search, block this and prevent the database save that
    – Pablote
    Oct 23, 2015 at 9:51
  • @Pablote good point, see my update, this might help with keeping the DB clean. As to bandwith, that might be a bit harder to prevent. Oct 23, 2015 at 10:28
  • not works :( i write that in the .htaccess I restart the server, clean the cache and nothing happends
    – Pablote
    Oct 24, 2015 at 15:43
  • 1
    Hi I find why not works I have a multistore configuration the adress are domain.com/store_code/catalogsearch/result/?q= I try some regex not succesful and finally I write 1 line by store. Redirect 302 /store_code/catalogsearch http://domain.com/errors/404.php thanks for your help!!
    – Pablote
    Oct 27, 2015 at 5:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.