HTTP: SQL Command Chain in URL Detection (2)
This signature detects a long SQL command sequence in a URL. Because SQL commands are not normally used in HTTP connections, this can indicate a SQL injection attack. This can also be a false positive. To reduce false positives, it is strongly recommended that these signatures only be used to inspect traffic from the Internet to your organization's Web servers that use SQL backend databases to generate content and not to inspect traffic going from your organization to the Internet.
Extended Description
By manipulating SQL queries in the URL, a malicious user is able to guide the execution flow of a SQL server to cause unexpected operations in the SQL backend. This results in data leaks, or false authentications.
Short Name
HTTP:SQL:INJ:CMD-CHAIN-2
Severity
Minor
Recommended
False
Recommended Action
None
Category
HTTP
Keywords
(2) CVE-2010-1071 CVE-2010-1496 CVE-2010-2719 CVE-2012-2171 CVE-2012-6588 CVE-2014-10038 CVE-2014-2587 CVE-2014-9440 CVE-2015-2182 CVE-2015-2183 CVE-2015-2196 CVE-2016-5792 Chain Command Detection SQL URL bid:1768 bid:66302 in
Release Date
05/26/2004
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3324
False Positive
Occasionally
CVSS Score
7.5
6.5
4.3