Jump to content

SQL injection victim, how to prevent?


ttocskcaj

Recommended Posts

Our admin panel for a gaming community was recently hit by a successful MySQL injection attack.

Here are the parameters they entered into forms to gain access.

 

${99319+100354}

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE acunetix [
  <!ENTITY acunetixent SYSTEM "http://testphp.vulnweb.com/dot.gif">
]>
<xxx>&acunetixent;</xxx>

 

Not sure which one worked, or how they even managed to POST to that page. But how do these two strings work? What do they do?

Link to comment
https://forums.phpfreaks.com/topic/260440-sql-injection-victim-how-to-prevent/
Share on other sites

I don't believe either of those strings would cause SQL Injection unless you were doing some really bad practices such as eval() on that data before creating the query.

 

Now, I can definitely see those strings causing other problems not related to SQL injection. What problems did you experience that makes you think this is SQL Injection and not XSS attack or some other problem?

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.