密码中的特殊字符导致内部服务器错误“通过 libinjection 检测到 SQL 注入攻击”-解网

问：

我有一个旧的自定义 php 网站，我一直在工作。我已经更新了 php 代码并具有密码重置功能。我将 Connections 文件夹移到了根文件夹之外，因为这是我读到的推荐操作方案。我的客户要求能够在密码重置中使用特殊字符。我有正则表达式，效果很好。一切似乎都在工作，除了当我尝试连续使用多个字符时，我收到内部服务器错误。当我检查错误日志时，它是这样说的：

ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"][msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:newPassword2: Abcd1234!@#$"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"]

这在我创建的测试网站上不是问题，但我在测试网站文件夹的根目录中也有数据库连接文件。在实时网站中，我在项目文件夹之外有连接文件，因为我读到这是最佳实践。

Connections folder
--connection.php
live website folder
--index.php
--other files, etc.

test website folder
--Connection.php
--other files

这是我更新密码的查询：

// if form is submitted and the value equals the value of the hidden input
if (isset($_POST['newPassword'])) {
    // password regex match
  if (!preg_match('/^(?=.*[A-Za-z])(?=.*\d)(?=.*[!#$%&()*@?^])[A-Za-z\d!#$%&()*@?^]{8,30}$/', $_POST['newPassword'])) {
    exit('password should be between 8 and 30 characters and contain at least one number and one special character');
  }
  // Check if both the password and confirm password fields match
  if ($_POST['newPassword'] != $_POST['newPassword2']) {
  exit('Passwords do not match!');
  }
  // set the date
  $month = date ("M");
  $year = date ("Y");
  $day = date ("j");
  // lastEditTime and lastEditedBy
  $lastEditTime = $month." ".$day.", ".$year; 
  $lastEditedBy = $_SESSION['MM_Username'];
  $userId = $_SESSION['MM_UserID'];
  $newPassword = password_hash($_POST['newPassword'],PASSWORD_DEFAULT);
  $updateStmt = $connection->prepare("UPDATE tbl_users SET newPassword= ?, lastEditedBy= ?, lastEditTime= ? WHERE userID= ?");
  $updateStmt->bind_param('sssi',$newPassword,$lastEditedBy,$lastEditTime,$userId);
  $updateStmt->execute();
    $updateStmt->close();     

  header("Location: reset4.php");
  exit;
}

我以前从未遇到过这个问题。有没有人对如何纠正这个问题有任何建议？

php sql 注入

密码中的特殊字符导致内部服务器错误“通过 libinjection 检测到 SQL 注入攻击”

Special characters in password causing internal server error "SQL Injection attack detected via libinjection"

评论

评论