1

My website was attacked yesterday, SQL injection attack thanks to the parameter left open

I made the necessary editing in php codes.

sql code of the attack

(SELECT 7105 FROM (SELECT(SLEEP(32-(IF(ORD(MID((SELECT HEX(IFNULL(CAST(table_name AS NCHAR),0x20)) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7472616b75735f647974726f726774657374 LIMIT 29,1),10,1))>49,0,32)))))FfpS)

I regularly review access and mysql logs. There were no new attacks on the url, but the slowness of my web site still continues.

I monitor the processes with the show full processlist command, sometimes the sleep command comes into play. Could a timer have been created?

zaferfrtlec1
  • 11
  • 1
  • 1
    Since the server was compromised, it is really difficult to find the scale of compromise. Safest option is to rebuild the server from latest backup. – Tero Kilkanen Jan 25 '21 at 18:49

0 Answers0