3

Recently, To improve our site security we implemented and enabled OWASP security in our server using mod_security.

After we enabled the OWASP security, whenever I try to create or edit contents in my site after logging in as admin, It is showing it as SQL INJECTION and it does not allow to crate or edit new node.

When I edit content it redirects me to "/node/1078/edit" and then it shows error 

"Error
The website encountered an unexpected error. Please try again later."

I also tried to find solution here but so far nothing helps. We have used drupal database API for all our database operations. I am not sure why OWASP is showing "SQL INJECTION".

How can I fix this?

Improve this question
0

2 Answers 2

Reset to default
3

I don't think it has something to do with Drupal. I faced similar issue before in WordPress and it was because of mod_security rules. Mod_security was blocking passing parameters in URLs. The top answer in this post might help you.

Improve this answer
2
  • so how did you resolve the problem
    – Hitesh
    Commented May 6, 2015 at 18:21
  • I was using a hosting service so they changed mod_security rules to fix the problem.
    – Ahmed Jabar
    Commented May 7, 2015 at 10:20
3

It would appear that OWASP think your site is vulnerable to SQL injection. You'll need to find the exact reason yourself (it requires debugging with the site in front of you), but here are some pointers:

  • Make sure your core version is >=7.32. There was a massive SQL hole in Drupal before that update.
  • Once that's confirmed, start disabling custom and contrib modules one-by-one, checking the edit form each time. If one of those is to blame, that simple process will find it. If you find a contrib module that's to blame, be sure to open a bug report on Drupal.org.
  • If your Drupal core version is up to date, and none of the custom/contrib modules are responsible, you'll need to contact OWASP to ask them for their criteria, and how they've arrived at the conclusion that your site is vulnerable.
  • On the off-chance they respond by pointing out another SQL injection vulnerability in Drupal core (very, very unlikely), be sure to report it to the security team. Same thing for contrib modules (more likely).
Improve this answer
1
  • Thanks @clive.. for helpful answer. I have drupal up to date and we also applied the security patch, let me try disabling custom and contrib modules one-by-one, checking the edit form each time. It will definitely help to narrow down the problem . Thanks
    – Hitesh
    Commented May 6, 2015 at 10:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.