Atomicorp WAF Rule 380122

Rule Summary

• Rule ID: 380122
• Status: Active
• Alert message: Atomicorp.com WAF Rules: MySQL and PostgreSQL stored procedure/function injections
• Observed CWEs: CWE-22 (1), CWE-74 (282), CWE-79 (11), CWE-89 (751), CWE-94 (2), CWE-200 (1), CWE-266 (1), CWE-284 (1), CWE-285 (1), CWE-287 (2), CWE-306 (1), CWE-352 (1), CWE-434 (1), CWE-862 (2), CWE-863 (1), CWE-918 (1)
• Revision: 5
• Rule severity: Critical (2)
• Phase: 2 (request body)
• Request surfaces: Request URI, Request headers, Request cookies, Request arguments, JSON request data, SOAP request data, XML request data
• Rule action: deny
• HTTP status: 403
• Public tags: SQLi
• Logging: log, auditlog

Description

This rule detects when either database store procedure or function content is detected in a POST from a client to the server. In most cases this indicates that the server is being attacked. If you believe this is a false positive, please report it our security team. This rule is unlikely to generate false positives, and we do not recommend you disable this rule.

Troubleshooting

False Positives

If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system.

Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

Documentation Source

• Original wiki page: WAF 380122
• Source revision: 6048
• Source revision date: 2020-08-24