SQLi bypass at PL4

_Issue originally created by user dune73 on date 2017-05-16 13:46:25. Link to original issue: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/782._

Ivan Novikov performed an auth/logic SQLi that bypasses PL4 and works on MySQL assuming column id exists.

curl -v -d "id=1.or-id" localhost

I really like the way he uses only two special chars to pull this of. Bonus points for using only special chars that 920274 allows. Impedance mismatch is such a pain in the ass.

[CRS-migration-bot]

User spartantri commented on date 2017-06-02 13:03:45:

csanders-git did you meant literal “.” or is it a wildcard? why is “or” repeated?

Have you tested that regex against “The migthy Thor.” (1 match) or “The mighty Thor. -Exists -in the Valhalla.Like it or not” (6 matches)? This have plenty of false positives so PL2 may not be the best place, what about PL3 and add some boundaries like:

(?i)(?:\d|\s|\w)(?😦?😦?:.|-)\b(?:or|all|and|any|between|exists|in|like|not|or|some)\b)|(?:\b(?:or|all|and|any|between|exists|in|like|not|or|some)\b(?:.|-)))

That would allow “The mighty Thor.” to pass and there are only three matches against the full sentece. 😃

After, there is the encoding issues urldecode, comments, utf…

Will using “+” execute as well? id=1.+or-id

[CRS-migration-bot]

User fgsch commented on date 2019-10-20 22:15:45:

This issue has timed out as it has not received any update in over 2 years. If this is still a problem please open a new issue.