XF 2.3 Possible SQL injection attack?

[Stubentiger]

I'm currently experiencing a large number of access attempts with the following pattern:

https://serversupportforum.de/members/fritzg.13386/?_xfRequestUri=/threads/server-vertragt-sich-nicht-mit-forensoftware-burning-board.50905/&_xfResponseType=json&_xfToken=1770637084%2C1d798a35ea9ed4c67adf59c36a99f475&_xfWithData=1&tooltip=trueXKEG3jx9%27)%20OR%20262=(SELECT%20262%20FROM%20PG_SLEEP(15))

These attempts appear illegitimate and are apparently not being detected by either mod_security or Cloudflare (free). What options are there to prevent these access attempts?

Xenforro 2.3.9

Thank you

 

[MentaL]

I'm currently experiencing a large number of access attempts with the following pattern:



These attempts appear illegitimate and are apparently not being detected by either mod_security or Cloudflare (free). What options are there to prevent these access attempts?

Xenforro 2.3.9

Thank you

Do you have the SQLi ruleset enabled via CF?

 

[Stubentiger]

Hi @MentaL,

thank you for your reply. As I mentioned, I'm using the Cloudflare free plan. To my knowledge, I have no way to enable or disable specific rulesets. If you can tell me how I can control the required settings, I'll provide the information immediately.

Edit: One more piece of information/question.

Even if this isn't necessarily an SQL issue, why is information (text output) displayed in the browser when the URL is accessed?

 

[MentaL]

Hi @MentaL,

thank you for your reply. As I mentioned, I'm using the Cloudflare free plan. To my knowledge, I have no way to enable or disable specific rulesets. If you can tell me how I can control the required settings, I'll provide the information immediately.

Edit: One more piece of information/question.

Even if this isn't necessarily an SQL issue, why is information (text output) displayed in the browser when the URL is accessed?

?_xfRequestUri=&_xfResponseType=json


it's a json output

 

[ES Dev Team]

If you click on that URL you can tell that the SQL injection is not working since you don't get a 15 second wait.
This person is testing your system for vulnerabilities, and in this case it looks the test is being failed.

Strange, this returns a 400 code which may not be tracked by existing security mechanisms for too many of that code per IP.