- 🇯🇵Japan ilfelice
Howdy,
As a temporary workaround, the Honeypot module may work to mitigate the risk.
I have identified a critical security issue in my Drupal website Webform where an attacker is injecting SQL code and automatically submitting the form. This poses a severe risk as it can lead to database exploitation, downtime, or unauthorized data access. I have received 300 emails within one hour due to this attack.This Sql Code automatically generate webform submissions.
Below are some of the payloads observed in the Webform submissions:
-5) OR 617=(SELECT 617 FROM PG_SLEEP(15))--
(SELECT (0) FROM (SELECT (SLEEP(15))) v)/*'+(SELECT (0) f
LOAE450H'; WAITFOR DELAY '0:0:1'
Active
6.2
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Howdy,
As a temporary workaround, the Honeypot module may work to mitigate the risk.