From what I understand, Yii was set up to prevent sql injections due to model posting. However, when running an Acunetix scan on my site (development mode), it is claiming a successful injection on our registration page (email form input). I can’t replicate the error (ie, the form correctly has an error validation since the sql injection is not valid email address). Has anyone experienced this or can comment on Yii as relates to SQL injections if we are using the Yii framework standard model->table mapping, so no actual SQL commands in our code)? Thanks.
its will be better if you will show us some code that its "injectable"
This is what the Acunetix report shows. To be clear, I haven’t been able to replicate the injection myself, so trying to understand how/why Acunetix can do it.
Details
/testit2/index.php
URL encoded POST input User%5bemail%5d was set to 'and(select 1 from(select count(*),concat((select
concat(CHAR(52),CHAR(67),CHAR(117),CHAR(71),CHAR(89),CHAR(51),CHAR(119),CHAR(106),CHAR(71),CHAR(80
),CHAR(48)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by
x)a)and'
Injected pattern found: 4CuGY3wjGP0
and
POST /testit2/index.php?r=user/create HTTP/1.1
Content-Length: 745
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=s5ncs4pfvtr3oj4ctcoacu24i6;
YII_CSRF_TOKEN=5684b2bfe32559cd77f958683dd8b7c6afed5246s%3A40%3A%224fb7cac0c60f6fe3bd94a
729d74e3e78410cd9c0%22%3B
Host: www.XXXXXXXX.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*
(line truncated)
...0%29%2cCHAR%2848%29%29%20from%20information_schema.tables%20limit%200%2c1%29%2cfloor%
28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29and%27
Request headers
&User%5bFirstName%5d=wutvuaog&User%5bLastName%5d=wutvuaog&User%5bpassword_unhash%5d=wutv
uaog&User%5bpassword_unhash_repeat%5d=wutvuaog&User%5bschoolType%5d=C&User%5btermagree%5
d=0&User%5btransType%5d=B&User%5busername%5d=wutvuaog&User%5bverifyCode%5d=wutvuaog&YII_
CSRF_TOKEN=4fb7cac0c60f6fe3bd94a729d74e3e78410cd9c0&yt0=Sign Up!
ok, can you show us the code that you programed? now from the software but the relevant php code