ModSecurity gives Generic SQL injection protection error

2
votes

I got this error on my Cpanel server. It doesn't happen on every update, just some SQL.

[Sat Mar 11 03:48:18.409435 2017] [:error] [pid 31376:tid 140202228020992] [client 180.253.119.171] ModSecurity: Access denied with code 500 (phase 2). Pattern match "((alter|create|drop)[[:space:]]+(column|database|procedure|table)|delete[[:space:]]+from|update.+set.+=)" at ARGS:description. [file "/usr/local/apache/conf/modsec2.user.conf"] [line "254"] [id "300015"] [rev "1"] [msg "Generic SQL injection protection"] [severity "CRITICAL"] [hostname ""] [uri "/app/marketwatch/edit-listing.php"] [unique_id "WMO50kPhgfkAAHqQRtMAAACP"]

What usually cause SQL Injection error and how to get rid of this error?

1
phpmysqlcpanelsql-injectionmod-security

1 Answers

3
votes

Solve it using this article: https://othermachines.com/blog/drupal-modsec-and-post-wouldnt-save

So, the mod_security got a false positive. I don't know somehow it uses modsec rule id 300015 instead of 300016 like usual and caught on false security rule. You can notice the id in [id "300015"]. So I edited modsec whitelisting in file /usr/local/apache/conf/modsec2/whitelist.conf and add this:

# Disable generic SQL injection rules globally
# for Drupal content admin
<LocationMatch /node/[0-9]+/edit> #might vary depending your code
  <IfModule mod_security2.c> # This is the important part
    SecRuleRemoveById 300015
  </IfModule>
</LocationMatch>

<LocationMatch /admin>
  <IfModule mod_security2.c>
    SecRuleRemoveById 300015
  </IfModule>
</LocationMatch>

Don't forget to restart Apache afterward so it will take effect.

UPDATE

Somehow the configuration location changes to /etc/apache2/conf.d/modsec2/whitelist.conf