{"id":7757,"date":"2022-06-24T16:09:37","date_gmt":"2022-06-24T07:09:37","guid":{"rendered":"https:\/\/www.auctionpro.co.kr\/?p=7757"},"modified":"2024-07-23T10:42:42","modified_gmt":"2024-07-23T01:42:42","slug":"wordpress-sql-injection","status":"publish","type":"post","link":"https:\/\/www.auctionpro.co.kr\/?p=7757","title":{"rendered":"wordpress SQL Injection"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><a rel=\"noreferrer noopener\" href=\"http:\/\/maps.google.com\/maps?q=22.2577991,114.1657028&amp;z=6\" target=\"_blank\">Hong Kong<\/a>&nbsp;was&nbsp;blocked by firewall for SQL Injection in query string:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Wordfence \ub85c\uadf8\uc0c1<\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"853\" src=\"https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection-1024x853.png\" alt=\"\" class=\"wp-image-7758\" srcset=\"https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection-1024x853.png 1024w, https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection-300x250.png 300w, https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection-768x640.png 768w, https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection.png 1083w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:vim decode:true \">https:\/\/mvc.auctionpro.co.kr\/?page_id=-4659%29+OR+3553%3D%28SELECT+UPPER%28XMLType%28CHR%2860%29%7C%7CCHR%2858%29%7C%7CCHR%28113%29%7C%7CCHR%28107%29%7C%7CCHR%28112%29%7C%7CCHR%28113%29%7C%7CCHR%28113%29%7C%7C%28SELECT+%28CASE+WHEN+%283553%3D3553%29+THEN+1+ELSE+0+END%29+FROM+DUAL%29%7C%7CCHR%28113%29%7C%7CCHR%28120%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%7C%7CCHR%28113%29%7C%7CCHR%2862%29%29%29+FROM+DUAL%29+AND+%282278%3D2278\n\nhttps:\/\/mvc.auctionpro.co.kr\/?page_id=-4659)+OR+3553=(SELECT+UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(107)||CHR(112)||CHR(113)||CHR(113)||(SELECT+(CASE+WHEN+(3553=3553)+THEN+1+ELSE+0+END)+FROM+DUAL)||CHR(113)||CHR(120)||CHR(106)||CHR(113)||CHR(113)||CHR(62)))+FROM+DUAL)+AND+(2278=2278<\/pre><\/div>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection_02.png\"><img loading=\"lazy\" decoding=\"async\" width=\"882\" height=\"681\" src=\"https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection_02.png\" alt=\"\" class=\"wp-image-7759\" srcset=\"https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection_02.png 882w, https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection_02-300x232.png 300w, https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2022\/06\/sqlinjection_02-768x593.png 768w\" sizes=\"auto, (max-width: 882px) 100vw, 882px\" \/><\/a><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">IP \uccb4\ud06c \ud558\ub2c8 \uacb0\uacfc\uac00 \uc5c6\uc2b5\ub2c8\ub2e4. \ub85c \ub098\uc635\ub2c8\ub2e4.<\/h3>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:vim decode:true \">We can't find any results. Possibly IP address is unallocated or its whois server is not available.<\/pre><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">sample 2<\/h2>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:vim decode:true \">\"GET \/?page_id=328%2F%2A%2A%2F%22%29%29%2F%2A%2A%2FUNION%2F%2A%2A%2FALL%2F%2A%2A%2F\nSELECT%2F%2A%2A%2F1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13\n%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C%28CHAR%28117%29%2BCHAR%2876%29%2BCHAR%2866%29%2BCHAR%28113%29%2B%28SELECT%2F%2A%2A%2F%28CASE%2F%2A%2A%2FWHEN%2F%2A%2A%2F%288919%3D8919%29%2F%2A%2A%2FTHEN%2F%2A%2A%2FCHAR%2849%29%2F%2A%2A%2FELSE%2F%2A%2A%2FCHAR%2848%29%2F%2A%2A%2FEND%29%29%2BCHAR%28105%29%2BCHAR%2897%29%2BCHAR%2869%29%2BCHAR%28111%29%29%2C29%2C30%2C31%2C32%2C33%2C34%2C35%2C36%2C37%2F%2A%2A%2F%2F%2A%2A%2F%2F%2A%2A%2FAND%2F%2A%2A%2F%28%28%22D8eD%22%2F%2A%2A%2FLIKE%2F%2A%2A%2F%22D8eD <\/pre><\/div>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:vim decode:true \">328\/**\/\"))\n\/**\/UNION\/**\/ALL\n\/**\/SELECT\/**\/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,\n(CHAR(117)+CHAR(76)+CHAR(66)+CHAR(113)+\n(SELECT\/**\/(CASE\/**\/WHEN\/**\/(8919=8919)\/**\/THEN\/**\/CHAR(49)\n\/**\/ELSE\/**\/CHAR(48)\/**\/END))+CHAR(105)+CHAR(97)+CHAR(69)+\nCHAR(111)),29,30,31,32,33,34,35,36,37\/**\/\/**\/\/**\/AND\/**\/((\"D8eD\"\/**\/LIKE\/**\/\"D8eD <\/pre><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Solution <\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">.htaccess  \uc5d0 \ucd94\uac00<\/h3>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:vim decode:true \">RewriteEngine On\nRewriteCond %{QUERY_STRING} (\\%27)|(\\')|(\\-\\-)|(\\%23)|(#)\nRewriteRule .* - [F]<\/pre><\/div>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>RewriteEngine On<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Apache \uc6f9 \uc11c\ubc84\uc758 URL \uc7ac\uc791\uc131 \uc5d4\uc9c4\uc744 \ucf2d\ub2c8\ub2e4. \uc774 \uc5d4\uc9c4\uc744 \ud1b5\ud574 URL\uc744 \uc7ac\uc791\uc131\ud558\uac70\ub098 \ud2b9\uc815 \uc870\uac74\uc5d0 \ub530\ub77c \uc694\uccad\uc744 \ucc28\ub2e8\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>RewriteCond %{QUERY_STRING} (%27)|(&#8216;)|(&#8211;)|(%23)|(#)<\/strong>:\n<ul class=\"wp-block-list\">\n<li><code>RewriteCond<\/code>\ub294 \uc7ac\uc791\uc131 \uc870\uac74\uc744 \uc9c0\uc815\ud569\ub2c8\ub2e4. \uc5ec\uae30\uc11c\ub294 <code>QUERY_STRING<\/code> (URL\uc758 \ucffc\ub9ac \ubb38\uc790\uc5f4)\uc774 \ud2b9\uc815 \ud328\ud134\uacfc \uc77c\uce58\ud558\ub294\uc9c0\ub97c \ud655\uc778\ud569\ub2c8\ub2e4.<\/li>\n\n\n\n<li><code>(\\%27)<\/code>\uc640 <code>(\\')<\/code>\ub294 URL\uc5d0 \ud3ec\ud568\ub41c \uc778\ucf54\ub529\ub41c \ub610\ub294 \uc77c\ubc18\uc801\uc778 \ub2e8\uc77c \uc778\uc6a9 \ubd80\ud638(&#8216;)\ub97c \ucc3e\uc2b5\ub2c8\ub2e4.<\/li>\n\n\n\n<li><code>(\\-\\-)<\/code>\ub294 SQL \uc8fc\uc11d \uad6c\ubb38\uc778 \uc5f0\uc18d\ub41c \ub450 \uac1c\uc758 \ud558\uc774\ud508(&#8211;)\uc744 \ucc3e\uc2b5\ub2c8\ub2e4.<\/li>\n\n\n\n<li><code>(\\%23)<\/code>\uc640 <code>(#)<\/code>\ub294 URL\uc5d0 \ud3ec\ud568\ub41c \uc778\ucf54\ub529\ub41c \ub610\ub294 \uc77c\ubc18\uc801\uc778 \ud574\uc2dc \uae30\ud638(#)\ub97c \ucc3e\uc2b5\ub2c8\ub2e4.<\/li>\n\n\n\n<li>\uc774\ub7ec\ud55c \ud328\ud134\uc740 \uc77c\ubc18\uc801\uc73c\ub85c SQL \uc778\uc81d\uc158 \uacf5\uaca9\uc774\ub098 \uae30\ud0c0 \uc545\uc131 \ud65c\ub3d9\uc5d0 \uc0ac\uc6a9\ub420 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>*<em>RewriteRule .<\/em> &#8211; [F]**:\n<ul class=\"wp-block-list\">\n<li><code>RewriteRule<\/code>\uc740 \uc870\uac74\uc5d0 \ub9de\ub294 \uacbd\uc6b0 \uc801\uc6a9\ud560 \uaddc\uce59\uc744 \uc9c0\uc815\ud569\ub2c8\ub2e4.<\/li>\n\n\n\n<li><code>.*<\/code>\ub294 \ubaa8\ub4e0 URL\uc744 \uc758\ubbf8\ud569\ub2c8\ub2e4.<\/li>\n\n\n\n<li><code>-<\/code>\ub294 URL\uc744 \ubcc0\uacbd\ud558\uc9c0 \uc54a\ub294\ub2e4\ub294 \uc758\ubbf8\uc785\ub2c8\ub2e4.<\/li>\n\n\n\n<li><code>[F]<\/code>\ub294 HTTP \uc0c1\ud0dc \ucf54\ub4dc 403 (Forbidden)\uc744 \ubc18\ud658\ud558\uc5ec \ud574\ub2f9 \uc694\uccad\uc744 \ucc28\ub2e8\ud569\ub2c8\ub2e4.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">\uc694\uc57d\ud558\uba74, \uc774 <code>.htaccess<\/code> \uc124\uc815\uc740 URL\uc758 \ucffc\ub9ac \ubb38\uc790\uc5f4\uc5d0 \ud2b9\uc815 \uc704\ud5d8\ud55c \ubb38\uc790\uac00 \ud3ec\ud568\ub41c \uacbd\uc6b0, \ud574\ub2f9 \uc694\uccad\uc744 403 Forbidden \uc0c1\ud0dc \ucf54\ub4dc\ub85c \ucc28\ub2e8\ud558\uc5ec \uc6f9 \uc0ac\uc774\ud2b8\ub97c \ubcf4\ud638\ud569\ub2c8\ub2e4.<\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>Hong Kong&nbsp;was&nbsp;blocked by firewall for SQL Injection in query string: Wordfence \ub85c\uadf8\uc0c1 IP \uccb4\ud06c \ud558\ub2c8 \uacb0\uacfc\uac00 \uc5c6\uc2b5\ub2c8\ub2e4. \ub85c \ub098\uc635\ub2c8\ub2e4. sample 2 Solution .htaccess \uc5d0 \ucd94\uac00 <a class=\"mh-excerpt-more\" href=\"https:\/\/www.auctionpro.co.kr\/?p=7757\" title=\"wordpress SQL Injection\">[&#8230;]<\/a><\/p>\n<\/div>","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[17],"tags":[],"class_list":["post-7757","post","type-post","status-publish","format-standard","hentry","category-17"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/posts\/7757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7757"}],"version-history":[{"count":0,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/posts\/7757\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}