SQL injection POST attacks

JM John

4/14/24, 3:35 AM

Just found hundreds of POST requests to user registration pages on Drupal site. No users are being registered but these requests are still getting 200 status from Drupal.

Are these requests doing any damage? Any preventive measures I can undertake other than blocking them through Firewall.

Post Data/Request Body:

"{\x22name\x22: \x22oXfxOznTkE\x22, \x22mail\x22: \[email protected]\x22, \x22form_build_id\x22: \x22form-FiEoO2JUzWA2PQIq0ryxRHqddnXXtEn0xoV6k4xvhrk\x22, \x22form_id\x22: \x22user_register_form\x22, \x22email\x22: \[email protected]\x22}"

Complete Request:

     213.155.160.239 - - [14/Apr/2023:03:27:02 +0000] "POST /user/register HTTP/1.1" 200 7167 "-" 
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36"
     "-" "{\x22name\x22: \x22oXfxOznTkE\x22, \x22mail\x22: \[email protected]\x22, \x22form_build_id\x22: \x22form-FiEoO2JUzWA2PQIq0ryxRHqddnXXtEn0xoV6k4xvhrk\x22, \x22form_id\x22: \x22user_register_form\x22,
 \x22email\x22: \[email protected]\x22}"

1 + 0

security

Score:0

Drupal

apaderno

4/14/24, 11:05 AM

They do not do any damage because Drupal core sanitizes user input when querying the database.

How that is done from a programmer perspective is explained in Writing secure code for Drupal / Use the database abstraction layer to avoid SQL injection attacks, where it is explained to never concatenate data directly into SQL queries, but use placeholders, as in the example code shown in that page.

\Database::getConnection()->query('SELECT foo FROM {table} t WHERE t.name = :name', [':name' => $_GET['user']]);

Using code similar to the following, the site could be subject to SQL injection.

\Database::getConnection()->query('SELECT foo FROM {table} t WHERE t.name = '. $_GET['user']);

If $_GET['user'] contains "" or "1" = "1", the resulting query would return any row in that table; if then the data would be shown on a page, the user would see all the table content.

+ 3

JM John

4/15/24, 3:58 AM

Thanks - Really appreciate the detailed answer. Would these POST requests cause Drupal cache to flush as I believe Cache is flush on new user being added to the site?

apaderno

4/15/24, 9:24 AM

For what I can see, the cache is not cleared when a new account is created.

JM John

4/17/24, 12:07 AM

Thanks mate - much appreciated.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: SQL injection POST attacks

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.