diff --git a/plugins/phpmyadmin-rule-exclusions-before.conf b/plugins/phpmyadmin-rule-exclusions-before.conf index 7fa7a91..ac36618 100644 --- a/plugins/phpmyadmin-rule-exclusions-before.conf +++ b/plugins/phpmyadmin-rule-exclusions-before.conf @@ -141,6 +141,7 @@ SecRule REQUEST_FILENAME "@endsWith /tbl_change.php" \ ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query" # Editing / copying a row - saving row data +# Keep in sync with rule 9513630. SecRule REQUEST_FILENAME "@endsWith /tbl_replace.php" \ "id:9513220,\ phase:1,\ @@ -177,6 +178,7 @@ SecRule REQUEST_FILENAME "@endsWith /tbl_replace.php" \ ctl:ruleRemoveTargetById=942190;ARGS,\ ctl:ruleRemoveTargetById=942230;ARGS,\ ctl:ruleRemoveTargetById=942550;ARGS,\ + ctl:ruleRemoveTargetById=932260;ARGS:fields_name[multi_edit][0][],\ ctl:ruleRemoveTargetById=920270;ARGS:fields[multi_edit][0][],\ ctl:ruleRemoveTargetById=930100;ARGS:fields[multi_edit][0][],\ ctl:ruleRemoveTargetById=930110;ARGS:fields[multi_edit][0][],\ @@ -216,6 +218,7 @@ SecRule REQUEST_FILENAME "@endsWith /sql.php" \ ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932115;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932235;ARGS:sql_query,\ + ctl:ruleRemoveTargetById=932260;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932370;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932380;ARGS:sql_query,\ ctl:ruleRemoveTargetById=933120;ARGS:sql_query,\ @@ -622,6 +625,7 @@ SecRule ARGS:route "@streq /table/change" \ ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query" # Editing / copying a row - saving row data +# Keep in sync with rule 9513220. SecRule ARGS:route "@streq /table/replace" \ "id:9513630,\ phase:1,\ @@ -658,6 +662,7 @@ SecRule ARGS:route "@streq /table/replace" \ ctl:ruleRemoveTargetById=942190;ARGS,\ ctl:ruleRemoveTargetById=942230;ARGS,\ ctl:ruleRemoveTargetById=942550;ARGS,\ + ctl:ruleRemoveTargetById=932260;ARGS:fields_name[multi_edit][0][],\ ctl:ruleRemoveTargetById=920270;ARGS:fields[multi_edit][0][],\ ctl:ruleRemoveTargetById=930100;ARGS:fields[multi_edit][0][],\ ctl:ruleRemoveTargetById=930110;ARGS:fields[multi_edit][0][],\ @@ -697,6 +702,7 @@ SecRule ARGS:route "@streq /sql" \ ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932115;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932235;ARGS:sql_query,\ + ctl:ruleRemoveTargetById=932260;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932370;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932380;ARGS:sql_query,\ ctl:ruleRemoveTargetById=933120;ARGS:sql_query,\ diff --git a/tests/regression/phpmyadmin-plugin/9513220.yaml b/tests/regression/phpmyadmin-plugin/9513220.yaml new file mode 100644 index 0000000..51fc68f --- /dev/null +++ b/tests/regression/phpmyadmin-plugin/9513220.yaml @@ -0,0 +1,25 @@ +# This test is disabled because it needs changes in the plugin configuration, which is currently not supported by FTW. +# --- +# meta: +# author: "azurit" +# description: "Test PhpMyAdmin Plugin" +# rule_id: 9513220 +# tests: +# - test_id: 1 +# desc: Check FPs with the lastLogin keyword +# stages: +# - input: +# dest_addr: 127.0.0.1 +# headers: +# Host: localhost +# User-Agent: "OWASP CRS test agent" +# Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 +# Cookie: phpMyAdmin=1 +# port: 80 +# method: POST +# version: HTTP/1.1 +# uri: /post/tbl_replace.php +# data: fields_name[multi_edit][0][]=lastLogin +# output: +# log: +# no_expect_ids: [932260] diff --git a/tests/regression/phpmyadmin-plugin/9513240.yaml b/tests/regression/phpmyadmin-plugin/9513240.yaml index b044698..13ad10c 100644 --- a/tests/regression/phpmyadmin-plugin/9513240.yaml +++ b/tests/regression/phpmyadmin-plugin/9513240.yaml @@ -70,3 +70,22 @@ # output: # log: # no_expect_ids: [933150] +# - test_id: 4 +# desc: Check FPs with the lastLogin keyword +# stages: +# - input: +# dest_addr: 127.0.0.1 +# headers: +# Host: localhost +# User-Agent: "OWASP CRS test agent" +# Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 +# Cookie: phpMyAdmin=1 +# Content-Type: application/x-www-form-urlencoded +# port: 80 +# method: POST +# version: HTTP/1.1 +# uri: /post/sql.php +# data: sql_query=SELECT%20%2A%20FROM%20%60database%60.%60table%60%20WHERE%20%28CONVERT%28%60login%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60name%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60email%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60role%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60passwordHash%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60lastLogin%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60failedAttempts%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60isBlocked%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60status%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60created%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%29 +# output: +# log: +# no_expect_ids: [932260] diff --git a/tests/regression/phpmyadmin-plugin/9513630.yaml b/tests/regression/phpmyadmin-plugin/9513630.yaml new file mode 100644 index 0000000..aee4a80 --- /dev/null +++ b/tests/regression/phpmyadmin-plugin/9513630.yaml @@ -0,0 +1,24 @@ +--- +meta: + author: "azurit" + description: "PhpMyAdmin Rule Exclusions Plugin" + rule_id: 9513630 +tests: + - test_id: 1 + desc: Check FPs with the lastLogin keyword + stages: + - input: + dest_addr: 127.0.0.1 + headers: + Host: localhost + User-Agent: "OWASP CRS test agent" + Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 + Cookie: phpMyAdmin=1 + port: 80 + method: POST + version: HTTP/1.1 + uri: /post/index.php?route=/table/replace + data: fields_name[multi_edit][0][]=lastLogin + output: + log: + no_expect_ids: [932260] diff --git a/tests/regression/phpmyadmin-plugin/9513650.yaml b/tests/regression/phpmyadmin-plugin/9513650.yaml index 028de46..3d62c3a 100644 --- a/tests/regression/phpmyadmin-plugin/9513650.yaml +++ b/tests/regression/phpmyadmin-plugin/9513650.yaml @@ -69,3 +69,22 @@ tests: output: log: no_expect_ids: [933150] + - test_id: 4 + desc: Check FPs with the lastLogin keyword + stages: + - input: + dest_addr: 127.0.0.1 + headers: + Host: localhost + User-Agent: "OWASP CRS test agent" + Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 + Cookie: phpMyAdmin=1 + Content-Type: application/x-www-form-urlencoded + port: 80 + method: POST + version: HTTP/1.1 + uri: /post/index.php?route=/sql + data: sql_query=SELECT%20%2A%20FROM%20%60database%60.%60table%60%20WHERE%20%28CONVERT%28%60login%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60name%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60email%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60role%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60passwordHash%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60lastLogin%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60failedAttempts%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60isBlocked%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60status%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60created%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%29 + output: + log: + no_expect_ids: [932260]