False Positive for SQLi

client9 / libinjection

SQL / SQLI tokenizer parser analyzer

Other

1k stars 274 forks source link

False Positive for SQLi #120

Open andywgrant opened 7 years ago

andywgrant commented 7 years ago

My ModSecurity logs are reporting a detection by libinjection that is clearly a false positive (even its matched data seems a little bizarre).

[msg "SQL Injection Attack Detected via libinjection"][data "Matched Data: novc found within ARGS:username: a!@#"]

jptosso commented 7 years ago

For now just create an exception. SecRuleUpdateTargetById <RULE ID TRIGGERED> "!ARGS:username" That will disable the rule validation for the parameter.