Is this an attack? 1

[Sleidia]

Hello,

It is the second time that I notice that someone or something sends a foreign query on my mysql database on my server. The output of the query is as follow :

You have an error in your SQL syntax near '

http://asap,http://asap'

at line 1

A google search with "

http://asap"

led me to 2 sites such as :
- Mc Affee ASAP (

http://asap.magic.fr/

)
- Alliance of Security Analysis Professionals (

http://asap.maddoktor2.com/

)

Although I'm not using ASP and Microsoft products, should I see it as a very dangerous threat?
What should I do?

Thanks for helping

 

[RVStevenson]

I am not an expert in this field but from the little information provided it appears to be user error. If there are continued attempts or actual attempts to access specific information in your database I would be more worried.

Thanks,

Ryan V. Stevenson
Specialty Services Director

National Support Network
East Lansing, MI - USA

Ryan@itpayz.com

http://www.itpayz.com

 

[zaznet]

How often do you see this kind of activity?

Looks more like a missconfigured script (does not need to be ASP, could be PHP or CGI/Perl)

Any other requests from the same host that use different syntax?

Just the one query by itself is not alarming. A frequent failed query might just mean you or someone using your database needs to fix something with their query/script.

Nathan aka: zaz (zaznet)
zaz@zaz.net

http://www.zaz.net/

 

[chiph]

It is the second time that I notice that someone or something sends a foreign query on my mysql database on my server

There's three possible sources for this:

1) Your MySQL database is visible to the world, and people are connecting to it and making arbitrary requests (extremely bad). To fix it: configure your firewall to block the ports that MySQL uses.

2) Your code is using string concatenation to build the SQL used to access the database. You're vulnerable to a SQL Injection attack, and people are taking advantage of the hole in your code (extremely bad). To fix it: change your code to use best-practices database access for your language.

3) There is a programming error in your code somewhere (bad). Fix your code.

And it might also be the catch-all:

4) Something else

Chip H.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first