Answers.Body: <p>The most reliable would be to get a timestamp of one of those records, then look in your web server logs for which URL was accessed at that time (within one second or so).  It should be a <code>POST</code> request, which should narrow things down if your site gets a lot of traffic.</p>
  <p>Under normal circumstances, you'll see the page get loaded first with a <code>GET</code> request by the same IP address, and then you can visit that page as an anonymous user, which should make clearer what happened.  However, with a bot, it's possible that someone just recorded the URL for <code>POST</code> requests.  It should still hopefully be obvious which URL was used.</p>
  <p>You should also go to <strong>Administer » System Settings » Misc</strong> and make sure <em>Accept profile submissions from external sites</em> is set to <strong>No</strong>.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-09-25T10:49:03.733Z
Answers.Text: Thank you; this is slightly beyond me at the moment, but it points me in the right direction.
Answers.UserDisplayName: Michael FORWARD
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-09-23T17:13:05.813Z
Answers.LastActivityDate: 2024-09-23T17:13:05.813Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Body: <p>I am new to this database (and to CiviCRM generally) but I am finding that it contains a lot of dud records over the last several months which appear to be code injection attempts. It's running on WordPress.</p>
  <p>For example, a display name of &quot;fnfOzvSR LoTTaXiD' OR 493=(SELECT 493 FROM PG_SLEEP(15))—&quot;</p>
  <p>I hope that these attempts will have been unsuccessful, but is there a way of tracing how they were generated? The activities they have seem to relate to forms which are not publicly visible.</p>
  
Tags: <security>
Title: Apparent Code Injection Attempt
ThreadText: # Apparent Code Injection Attempt
  
  (Asked by: username_0 on 2024-09-23)
  
  I am new to this database (and to CiviCRM generally) but I am finding that it contains a lot of dud records over the last several months which appear to be code injection attempts. It's running on WordPress.
  
  For example, a display name of "fnfOzvSR LoTTaXiD' OR 493=(SELECT 493 FROM PG\_SLEEP(15))—"
  
  I hope that these attempts will have been unsuccessful, but is there a way of tracing how they were generated? The activities they have seem to relate to forms which are not publicly visible.
  
  **Tags:** security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-09-23. Score: 4
  
  The most reliable would be to get a timestamp of one of those records, then look in your web server logs for which URL was accessed at that time (within one second or so). It should be a `POST` request, which should narrow things down if your site gets a lot of traffic.
  
  Under normal circumstances, you'll see the page get loaded first with a `GET` request by the same IP address, and then you can visit that page as an anonymous user, which should make clearer what happened. However, with a bot, it's possible that someone just recorded the URL for `POST` requests. It should still hopefully be obvious which URL was used.
  
  You should also go to **Administer » System Settings » Misc** and make sure *Accept profile submissions from external sites* is set to **No**.
  
  > **Comments:**
  > **username_0**: Thank you; this is slightly beyond me at the moment, but it points me in the right direction.  
  
  ---
  
  