Answers.Body: <p>CiviCRM 4.5.x branch has stopped receiving security updates a very long time ago. Best to upgrade to 4.6.x or 4.7.x as soon as possible!</p>
  
  <p>If you need help - find a partner near you in the partner listings: <a href="https://civicrm.org/partners-contributors" rel="nofollow">https://civicrm.org/partners-contributors</a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-06-30T17:26:20.627Z
Answers.Text: Upgrades can be daunting - but they don't have to be - if you've never hacked your CiviCRM and have never made schema changes to its table structure - then you'll likely be ok; you may just have to review custom_php files (if you have them) and extensions;
Answers.UserDisplayName: KarinG - Semper IT
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-06-30T20:15:26.563Z
Answers.Text: Yeah, unfortunately for this site there are a TON of customizations as you mention and custom extensions that would make it a bit of a bear... THANK YOU though!
Answers.UserDisplayName: nocabt
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-06-28T12:35:35.890Z
Answers.LastActivityDate: 2016-06-28T12:35:35.890Z
Answers.UserDisplayName: KarinG - Semper IT
Body: <p>on CiviCRM 4.5.4 on Drupal, PCI vendor is reporting errors along the lines of:</p>
  
  <blockquote>
    <p>Using the GET HTTP method, XYZ found that : + The following resources
    may be vulnerable to blind SQL injection : + The 'snippet' parameter
    of the /civicrm/mailing/subscribe CGI : /civicrm/mailing/subscribe?
    mark_x_2=1&amp;recaptcha_response_field=manual_ch
    allenge&amp;recaptcha_challenge_field=&amp;qfKey=03baf253d7e24b62a4d8b8e76939c
    36
    3_6657&amp;mark_x_45=1&amp;_qf_Subscribe_cancel=Cancel&amp;_qf_Subscribe_next=Subs
    cr ibe&amp;_qf_default=Subscribe%3anext&amp;email=Email%20Sign-</p>
  </blockquote>
  
  <p>In addition there are a number of other parameters they report, like "recaptcha_response_field", "recaptcha_challenge_field", "qfKey", "mark_x_45", and others.</p>
  
  <p>I'm fairly certain this is a false positive, but need some justification.</p>
  
  <p>Thank you!</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-06-29T05:09:14.933Z
Comments.Text: As Karin points out, your PCI auditor is correct - there have been [many CiviCRM security updates](https://civicrm.org/advisory) since 4.5.4 including several SQL injection issues, and you should upgrade ASAP to secure your contacts' data. Check the CiviCRM docs for upgrade documentation, and make sure to test thoroughly before upgrading your live site. You are very welcome to send your audit report to `security@civicrm.org` in case some new issue has been identified.
Comments.UserDisplayName: Chris Burgess
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-06-29T05:11:52.933Z
Comments.Text: If you administer a CiviCRM site, I recommend subscribing to the advisories which are sent out by email when a new security release is made. https://civicrm.org/receive-security-advisories
Comments.UserDisplayName: Chris Burgess
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-06-30T20:16:04.007Z
Comments.Text: Good idea I'm going to subscribe to that, thanks.
Comments.UserDisplayName: nocabt
Tags: <security><4.5><pci-compliance>
Title: Outdated CiviCRM, blind SQL injection risk on parameters? (PCI compliance failure)
ThreadText: # Outdated CiviCRM, blind SQL injection risk on parameters? (PCI compliance failure)
  
  (Asked by: username_0 on 2016-06-27)
  
  on CiviCRM 4.5.4 on Drupal, PCI vendor is reporting errors along the lines of:
  
  > Using the GET HTTP method, XYZ found that : + The following resources
  > may be vulnerable to blind SQL injection : + The 'snippet' parameter
  > of the /civicrm/mailing/subscribe CGI : /civicrm/mailing/subscribe?
  > mark\_x\_2=1&recaptcha\_response\_field=manual\_ch
  > allenge&recaptcha\_challenge\_field=&qfKey=03baf253d7e24b62a4d8b8e76939c
  > 36
  > 3\_6657&mark\_x\_45=1&\_qf\_Subscribe\_cancel=Cancel&\_qf\_Subscribe\_next=Subs
  > cr ibe&\_qf\_default=Subscribe%3anext&email=Email%20Sign-
  
  In addition there are a number of other parameters they report, like "recaptcha\_response\_field", "recaptcha\_challenge\_field", "qfKey", "mark\_x\_45", and others.
  
  I'm fairly certain this is a false positive, but need some justification.
  
  Thank you!
  
  **Tags:** security, 4.5, pci-compliance
  
  > **Comments:**
  > **username_1**: As Karin points out, your PCI auditor is correct - there have been [many CiviCRM security updates](https://civicrm.org/advisory) since 4.5.4 including several SQL injection issues, and you should upgrade ASAP to secure your contacts' data. Check the CiviCRM docs for upgrade documentation, and make sure to test thoroughly before upgrading your live site. You are very welcome to send your audit report to `security@civicrm.org` in case some new issue has been identified.  
  > **username_1**: If you administer a CiviCRM site, I recommend subscribing to the advisories which are sent out by email when a new security release is made. https://civicrm.org/receive-security-advisories  
  > **username_0**: Good idea I'm going to subscribe to that, thanks.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2016-06-28. Score: 2 | Accepted answer
  
  CiviCRM 4.5.x branch has stopped receiving security updates a very long time ago. Best to upgrade to 4.6.x or 4.7.x as soon as possible!
  
  If you need help - find a partner near you in the partner listings: <https://civicrm.org/partners-contributors>
  
  > **Comments:**
  > **username_2**: Upgrades can be daunting - but they don't have to be - if you've never hacked your CiviCRM and have never made schema changes to its table structure - then you'll likely be ok; you may just have to review custom_php files (if you have them) and extensions;  
  > **username_0**: Yeah, unfortunately for this site there are a TON of customizations as you mention and custom extensions that would make it a bit of a bear... THANK YOU though!  
  
  ---
  
  