On this page

Atomicorp WAF Rule 361022

Rule Summary

  • Rule ID: 361022
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: Potential SQL Information Leakage
  • Observed CWEs: None documented
  • Revision: 2
  • Rule severity: Alert (1)
  • Phase: 4 (response body)
  • Request surfaces: Response body
  • Rule action: deny
  • HTTP status: 404
  • Public tags: no_ar
  • Logging: log, auditlog

Description

This rules detects when an application return an SQL error message. This rules does not cause this and does not block any action. Disabling this rule will not have any effect on the applications SQL error. The rule just detects when an SQL error is detected in the data sent from your web server to your users. This information may include sensitive information, such as passwords, or this may indicate that an attacker is attempting to find flaws in your applications.

We recommend you investigate the cause of the SQL error, as this may indicate an attack is in progress.

Troubleshooting

False Positives

A false positive could occur if a user posted an SQL error message to forum, blog or other content management system. This rule looks for specific error messages in the content of the data returned to the user, not the data sent by the user. Please check the content of the event before reporting this as a false positive. If the event was a real SQL error message returned by your server, then do not report this as a false positive, the rule is working correctly.

Tuning Guidance

See the Mod_security page for guidance on tuning this rule.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 361022
  • Source revision: 3535
  • Source revision date: 2013-06-17