From cd72acd6c88be367c1d9c7473675bfbd11bf5ede Mon Sep 17 00:00:00 2001 From: azurit Date: Fri, 17 Jul 2026 13:09:15 +0200 Subject: [PATCH 1/8] Update phpmyadmin-rule-exclusions-before.conf --- plugins/phpmyadmin-rule-exclusions-before.conf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/plugins/phpmyadmin-rule-exclusions-before.conf b/plugins/phpmyadmin-rule-exclusions-before.conf index 7fa7a91..ac36618 100644 --- a/plugins/phpmyadmin-rule-exclusions-before.conf +++ b/plugins/phpmyadmin-rule-exclusions-before.conf @@ -141,6 +141,7 @@ SecRule REQUEST_FILENAME "@endsWith /tbl_change.php" \ ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query" # Editing / copying a row - saving row data +# Keep in sync with rule 9513630. SecRule REQUEST_FILENAME "@endsWith /tbl_replace.php" \ "id:9513220,\ phase:1,\ @@ -177,6 +178,7 @@ SecRule REQUEST_FILENAME "@endsWith /tbl_replace.php" \ ctl:ruleRemoveTargetById=942190;ARGS,\ ctl:ruleRemoveTargetById=942230;ARGS,\ ctl:ruleRemoveTargetById=942550;ARGS,\ + ctl:ruleRemoveTargetById=932260;ARGS:fields_name[multi_edit][0][],\ ctl:ruleRemoveTargetById=920270;ARGS:fields[multi_edit][0][],\ ctl:ruleRemoveTargetById=930100;ARGS:fields[multi_edit][0][],\ ctl:ruleRemoveTargetById=930110;ARGS:fields[multi_edit][0][],\ @@ -216,6 +218,7 @@ SecRule REQUEST_FILENAME "@endsWith /sql.php" \ ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932115;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932235;ARGS:sql_query,\ + ctl:ruleRemoveTargetById=932260;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932370;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932380;ARGS:sql_query,\ ctl:ruleRemoveTargetById=933120;ARGS:sql_query,\ @@ -622,6 +625,7 @@ SecRule ARGS:route "@streq /table/change" \ ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query" # Editing / copying a row - saving row data +# Keep in sync with rule 9513220. SecRule ARGS:route "@streq /table/replace" \ "id:9513630,\ phase:1,\ @@ -658,6 +662,7 @@ SecRule ARGS:route "@streq /table/replace" \ ctl:ruleRemoveTargetById=942190;ARGS,\ ctl:ruleRemoveTargetById=942230;ARGS,\ ctl:ruleRemoveTargetById=942550;ARGS,\ + ctl:ruleRemoveTargetById=932260;ARGS:fields_name[multi_edit][0][],\ ctl:ruleRemoveTargetById=920270;ARGS:fields[multi_edit][0][],\ ctl:ruleRemoveTargetById=930100;ARGS:fields[multi_edit][0][],\ ctl:ruleRemoveTargetById=930110;ARGS:fields[multi_edit][0][],\ @@ -697,6 +702,7 @@ SecRule ARGS:route "@streq /sql" \ ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932115;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932235;ARGS:sql_query,\ + ctl:ruleRemoveTargetById=932260;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932370;ARGS:sql_query,\ ctl:ruleRemoveTargetById=932380;ARGS:sql_query,\ ctl:ruleRemoveTargetById=933120;ARGS:sql_query,\ From abe03d14078cce035dc22a27f918285143cab7ab Mon Sep 17 00:00:00 2001 From: azurit Date: Fri, 17 Jul 2026 13:21:56 +0200 Subject: [PATCH 2/8] Disable PhpMyAdmin Plugin test 9513220 This test is disabled due to unsupported plugin configuration changes. --- .../regression/phpmyadmin-plugin/9513220.yaml | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 tests/regression/phpmyadmin-plugin/9513220.yaml diff --git a/tests/regression/phpmyadmin-plugin/9513220.yaml b/tests/regression/phpmyadmin-plugin/9513220.yaml new file mode 100644 index 0000000..cf5967f --- /dev/null +++ b/tests/regression/phpmyadmin-plugin/9513220.yaml @@ -0,0 +1,25 @@ +# This test is disabled because it needs changes in the plugin configuration, which is currently not supported by FTW. +# --- +# meta: +# author: "azurit" +# description: "Test PhpMyAdmin Plugin" +# rule_id: 9513220 +# tests: +# - test_id: 1 +# desc: Check FPs with the CONVERT keyword +# stages: +# - input: +# dest_addr: 127.0.0.1 +# headers: +# Host: localhost +# User-Agent: "OWASP CRS test agent" +# Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 +# Cookie: phpMyAdmin=1 +# port: 80 +# method: POST +# version: HTTP/1.1 +# uri: /post/tbl_replace.php +# data: fields_name[multi_edit][0][]=lastLogin +# output: +# log: +# no_expect_ids: [932260] From 1e15ef6fdda6bb39ea4562774c4ae6956b5277b5 Mon Sep 17 00:00:00 2001 From: azurit Date: Fri, 17 Jul 2026 13:24:14 +0200 Subject: [PATCH 3/8] Update test description in 9513220.yaml --- tests/regression/phpmyadmin-plugin/9513220.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/regression/phpmyadmin-plugin/9513220.yaml b/tests/regression/phpmyadmin-plugin/9513220.yaml index cf5967f..51fc68f 100644 --- a/tests/regression/phpmyadmin-plugin/9513220.yaml +++ b/tests/regression/phpmyadmin-plugin/9513220.yaml @@ -6,7 +6,7 @@ # rule_id: 9513220 # tests: # - test_id: 1 -# desc: Check FPs with the CONVERT keyword +# desc: Check FPs with the lastLogin keyword # stages: # - input: # dest_addr: 127.0.0.1 From 15a44f756871a06e88e1c5ff6ff792c1f4496bd0 Mon Sep 17 00:00:00 2001 From: azurit Date: Fri, 17 Jul 2026 13:26:21 +0200 Subject: [PATCH 4/8] Create 9513630.yaml --- .../regression/phpmyadmin-plugin/9513630.yaml | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 tests/regression/phpmyadmin-plugin/9513630.yaml diff --git a/tests/regression/phpmyadmin-plugin/9513630.yaml b/tests/regression/phpmyadmin-plugin/9513630.yaml new file mode 100644 index 0000000..aee4a80 --- /dev/null +++ b/tests/regression/phpmyadmin-plugin/9513630.yaml @@ -0,0 +1,24 @@ +--- +meta: + author: "azurit" + description: "PhpMyAdmin Rule Exclusions Plugin" + rule_id: 9513630 +tests: + - test_id: 1 + desc: Check FPs with the lastLogin keyword + stages: + - input: + dest_addr: 127.0.0.1 + headers: + Host: localhost + User-Agent: "OWASP CRS test agent" + Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 + Cookie: phpMyAdmin=1 + port: 80 + method: POST + version: HTTP/1.1 + uri: /post/index.php?route=/table/replace + data: fields_name[multi_edit][0][]=lastLogin + output: + log: + no_expect_ids: [932260] From 38dd576546bff62f48ce72f0b361ce5cf9986ac1 Mon Sep 17 00:00:00 2001 From: azurit Date: Fri, 17 Jul 2026 13:35:11 +0200 Subject: [PATCH 5/8] Update 9513650.yaml --- .../regression/phpmyadmin-plugin/9513650.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/tests/regression/phpmyadmin-plugin/9513650.yaml b/tests/regression/phpmyadmin-plugin/9513650.yaml index 028de46..f42a04e 100644 --- a/tests/regression/phpmyadmin-plugin/9513650.yaml +++ b/tests/regression/phpmyadmin-plugin/9513650.yaml @@ -69,3 +69,22 @@ tests: output: log: no_expect_ids: [933150] + - test_id: 4 + desc: Check FPs with the lastLogin keyword + stages: + - input: + dest_addr: 127.0.0.1 + headers: + Host: localhost + User-Agent: "OWASP CRS test agent" + Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 + Cookie: phpMyAdmin=1 + Content-Type: application/x-www-form-urlencoded + port: 80 + method: POST + version: HTTP/1.1 + uri: /post/index.php?route=/sql + data: sql_query=SELECT%20%2A%20FROM%20%60database%60.%60table%60%20WHERE%20%28CONVERT%28%60login%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60name%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60email%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60role%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60passwordHash%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60lastLogin%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60failedAttempts%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60isBlocked%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60status%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60created%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60modified%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%29 + output: + log: + no_expect_ids: [932260] From 2dc29099b9dfba49b3f2f65b86f3340470d9bead Mon Sep 17 00:00:00 2001 From: azurit Date: Fri, 17 Jul 2026 13:36:16 +0200 Subject: [PATCH 6/8] Update 9513240.yaml --- .../regression/phpmyadmin-plugin/9513240.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/tests/regression/phpmyadmin-plugin/9513240.yaml b/tests/regression/phpmyadmin-plugin/9513240.yaml index b044698..1c2940f 100644 --- a/tests/regression/phpmyadmin-plugin/9513240.yaml +++ b/tests/regression/phpmyadmin-plugin/9513240.yaml @@ -70,3 +70,22 @@ # output: # log: # no_expect_ids: [933150] +# - test_id: 4 +# desc: Check FPs with the lastLogin keyword +# stages: +# - input: +# dest_addr: 127.0.0.1 +# headers: +# Host: localhost +# User-Agent: "OWASP CRS test agent" +# Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 +# Cookie: phpMyAdmin=1 +# Content-Type: application/x-www-form-urlencoded +# port: 80 +# method: POST +# version: HTTP/1.1 +# uri: /post/sql.php +# data: sql_query=SELECT%20%2A%20FROM%20%60database%60.%60table%60%20WHERE%20%28CONVERT%28%60login%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60name%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60email%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60role%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60passwordHash%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60lastLogin%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60failedAttempts%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60isBlocked%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60status%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60created%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60modified%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%29 +# output: +# log: +# no_expect_ids: [932260] From 42a549ca31ce671cc184fb934504e1a9c0e9f389 Mon Sep 17 00:00:00 2001 From: azurit Date: Fri, 17 Jul 2026 14:16:45 +0200 Subject: [PATCH 7/8] Update 9513240.yaml --- tests/regression/phpmyadmin-plugin/9513240.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/regression/phpmyadmin-plugin/9513240.yaml b/tests/regression/phpmyadmin-plugin/9513240.yaml index 1c2940f..13ad10c 100644 --- a/tests/regression/phpmyadmin-plugin/9513240.yaml +++ b/tests/regression/phpmyadmin-plugin/9513240.yaml @@ -85,7 +85,7 @@ # method: POST # version: HTTP/1.1 # uri: /post/sql.php -# data: sql_query=SELECT%20%2A%20FROM%20%60database%60.%60table%60%20WHERE%20%28CONVERT%28%60login%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60name%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60email%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60role%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60passwordHash%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60lastLogin%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60failedAttempts%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60isBlocked%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60status%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60created%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60modified%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%29 +# data: sql_query=SELECT%20%2A%20FROM%20%60database%60.%60table%60%20WHERE%20%28CONVERT%28%60login%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60name%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60email%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60role%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60passwordHash%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60lastLogin%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60failedAttempts%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60isBlocked%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60status%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60created%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%29 # output: # log: # no_expect_ids: [932260] From e9744b2f459719d75166461304d43ea4721620c2 Mon Sep 17 00:00:00 2001 From: azurit Date: Fri, 17 Jul 2026 14:17:21 +0200 Subject: [PATCH 8/8] Update SQL query in regression test YAML file --- tests/regression/phpmyadmin-plugin/9513650.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/regression/phpmyadmin-plugin/9513650.yaml b/tests/regression/phpmyadmin-plugin/9513650.yaml index f42a04e..3d62c3a 100644 --- a/tests/regression/phpmyadmin-plugin/9513650.yaml +++ b/tests/regression/phpmyadmin-plugin/9513650.yaml @@ -84,7 +84,7 @@ tests: method: POST version: HTTP/1.1 uri: /post/index.php?route=/sql - data: sql_query=SELECT%20%2A%20FROM%20%60database%60.%60table%60%20WHERE%20%28CONVERT%28%60login%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60name%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60email%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60role%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60passwordHash%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60lastLogin%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60failedAttempts%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60isBlocked%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60status%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60created%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60modified%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%29 + data: sql_query=SELECT%20%2A%20FROM%20%60database%60.%60table%60%20WHERE%20%28CONVERT%28%60login%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60name%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60email%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60role%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60passwordHash%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60lastLogin%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60failedAttempts%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60isBlocked%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60status%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%20OR%20CONVERT%28%60created%60%20USING%20utf8%29%20LIKE%20%27%25name%40example.com%25%27%29 output: log: no_expect_ids: [932260]