Answers.Body: <p>It's a SQL injection attempt, where it's looking to see if it gets used in a query and alters it. Depending on the query where it gets used, it could do nothing or it could do something, but at the very least tells the attacker if it's vulnerable. Simple example, where it does nothing:</p>
  
  <p>If civi had code like this, where it doesn't escape the value:</p>
  
  <pre><code>$reset = $_GET['reset'];
  $dao = CRM_Core_DAO::executeQuery("SELECT * FROM table WHERE something='$reset'");
  </code></pre>
  
  <p>That particular url would translate to:</p>
  
  <pre><code>$reset = $_GET['reset'];
  $dao = CRM_Core_DAO::executeQuery("SELECT * FROM table WHERE something='1' AND 6876 IN (SELECT (1)) AND 'KFmQ'='KFmQ'");
  </code></pre>
  
  <p>which is valid SQL and does something different than intended. In my example all it does is tell the attacker it's vulnerable, but there's lots of variations.</p>
  
  <p>Since IDS is catching it, you get the log errors.</p>
  
  <p>If it's always the same IP, you can block the IP.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-05-08T22:11:29.477Z
Answers.Text: Thanks for explaining. Is there a way to automatically/programmatically block this kind of multiple number of attempt within a short period of time? It appears that they change their IP or user VPN for this kind of activity.
Answers.UserDisplayName: Tapash
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-05-08T22:18:51.473Z
Answers.Text: You could do it at the web server level, e.g. in apache in httpd.conf or .htaccess drop the request if it matches a pattern, so it doesn't even reach drupal.
Answers.UserDisplayName: Demerit
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-05-09T09:51:02.693Z
Answers.Text: Great tips. Thanks a million!
Answers.UserDisplayName: Tapash
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-05-08T15:09:40.220Z
Answers.LastActivityDate: 2020-05-08T15:16:21.643Z
Answers.LastEditDate: 2020-05-08T15:16:21.643Z
Answers.UserDisplayName: Demerit
Body: <p>I find 100s of these types of entries in my drupal log. It tries URLs like this below. It happens when there's very less traffic on our site. What is it trying to do? Is it a security threat? Can it cause any harm to our site &amp; data? Can they be stopped?</p>
  
  <pre><code>https://example.com/civicrm/contribute/transact?reset=1%27%20AND%206876%20IN%20%28SELECT%20%28CHAR%28113%29%2BCHAR%28106%29%2BCHAR%2898%29%2BCHAR%28122%29%2BCHAR%28113%29%2B%28SELECT%20%28CASE%20WHEN%20%286876%3D6876%29%20THEN%20CHAR%2849%29%20ELSE%20CHAR%2848%29%20END%29%29%2BCHAR%28113%29%2BCHAR%28118%29%2BCHAR%28106%29%2BCHAR%28112%29%2BCHAR%28113%29%29%29%20AND%20%27KFmQ%27%3D%27KFmQ&amp;id=10
  </code></pre>
  
  <p><a href="https://i.sstatic.net/HIfjs.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/HIfjs.png" alt="enter image description here"></a></p>
  
Tags: <security><urls><security-advisory>
Title: What this bot/IP trying to do on my civicrm site?
ThreadText: # What this bot/IP trying to do on my civicrm site?
  
  (Asked by: username_0 on 2020-05-08)
  
  I find 100s of these types of entries in my drupal log. It tries URLs like this below. It happens when there's very less traffic on our site. What is it trying to do? Is it a security threat? Can it cause any harm to our site & data? Can they be stopped?
  https://example.com/civicrm/contribute/transact?reset=1%27%20AND%206876%20IN%20%28SELECT%20%28CHAR%28113%29%2BCHAR%28106%29%2BCHAR%2898%29%2BCHAR%28122%29%2BCHAR%28113%29%2B%28SELECT%20%28CASE%20WHEN%20%286876%3D6876%29%20THEN%20CHAR%2849%29%20ELSE%20CHAR%2848%29%20END%29%29%2BCHAR%28113%29%2BCHAR%28118%29%2BCHAR%28106%29%2BCHAR%28112%29%2BCHAR%28113%29%29%29%20AND%20%27KFmQ%27%3D%27KFmQ&id=10
  
  **Tags:** security, urls, security-advisory
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-05-08. Score: 1 | Accepted answer
  
  It's a SQL injection attempt, where it's looking to see if it gets used in a query and alters it. Depending on the query where it gets used, it could do nothing or it could do something, but at the very least tells the attacker if it's vulnerable. Simple example, where it does nothing:
  If civi had code like this, where it doesn't escape the value:
  $reset = $_GET['reset'];
  $dao = CRM_Core_DAO::executeQuery("SELECT * FROM table WHERE something='$reset'");
  
  That particular url would translate to:
  $reset = $_GET['reset'];
  $dao = CRM_Core_DAO::executeQuery("SELECT * FROM table WHERE something='1' AND 6876 IN (SELECT (1)) AND 'KFmQ'='KFmQ'");
  
  which is valid SQL and does something different than intended. In my example all it does is tell the attacker it's vulnerable, but there's lots of variations.
  Since IDS is catching it, you get the log errors.
  If it's always the same IP, you can block the IP.
  
  > **Comments:**
  > **username_0**: Thanks for explaining. Is there a way to automatically/programmatically block this kind of multiple number of attempt within a short period of time? It appears that they change their IP or user VPN for this kind of activity.  
  > **username_1**: You could do it at the web server level, e.g. in apache in httpd.conf or .htaccess drop the request if it matches a pattern, so it doesn't even reach drupal.  
  > **username_0**: Great tips. Thanks a million!  
  
  ---
  
  