1

Here is a minimum working example of the issue I have. I know by now the error seems to be particular of my server/setup, but I'm still curious about what is going on. There are two files, m1.php and m2.php:

m1.php

<form action="m2.php" method="post">
<br> <input type="text" name="j" />
<input type="submit"  VALUE="Ok"  />
</form>

m2.php

<?php  
print_r($_POST);
?>

Everything works as expected (when you click ok, it prints the array with the value from the input box) with this exception: if the string I type is

VALUE';WAITFOR DELAY '00:00:24';--

the form is not processed. Deleting just one character from the above string works with no issues.

Checking the server logs, when the above string is the input no POST request appears on the log, while it does with any other string I can think of. The problem seems to be server-side, as Fiddler shows the POST request with content

j=VALUE%27%3BWAITFOR+DELAY+%2700%3A00%3A24%27%3B--

and I could reproduce it in different browsers from different platforms. Is this an Apache issue? Maybe php? How could I tell?

I found this while running a security audit on the web site. There is no SQL server running, but the audit reports the issue. And I'm curious why that particular string triggers such behaviour.

Edit: in case anyone is interested, I just noticed that the behaviour described above does not depend on the php code at all. In fact, if I send via Fiddler a POST request to a non-existing page on my server, as long as the post content includes some field with the aforementioned string, the request goes unanswered. So it seems this is an Apache issue.

2
  • What Apache and PHP modules do you have enabled? For example mod_security? Setup separate apache instance with just 1-2 processes running, attach strace to them (using -p PID option) to see what it is doing while processing that request. It works on my apache/php without any issues, so it must be something in your configuration. – Marki555 May 15 '15 at 19:45
  • I'll try that, thanks. It doesn't affect anything in my server, but it makes me really curious why a particular string blows up. – Martin Argerami May 16 '15 at 5:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.