Support

Home Forums Event Espresso Premium Security Scanner fails & sayin website is vulnerable to SQL injection attacks.

Security Scanner fails & sayin website is vulnerable to SQL injection attacks.

Posted: September 17, 2012 at 11:43 am


Khalifa Alshammiry

September 17, 2012 at 11:43 am

Our Site is hosted in Godaddy.com and it inform that our site is failed form the security scan and vulnerable to SQL injections. I have installed the wordpress firewall as well still same result. here is the error message. Please advise on this. Thank you.

Using the POST HTTP method, Site Scanner found that : + The following resources may be vulnerable to SQL injection : + The ‘regevent_action’ parameter of the / CGI : /?page_id=164 [regevent_action=post_attendee] -–|-–|– output -–|-–|– Warning: Invalid argument supplied for foreach() in /ho […]

**WordPress database error: [You hav e an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘) ORDER BY q.id ASC’ at line 7] SELECT q.*, qg.group_name
FROM wp_events_question q

  • This topic was modified 8 years, 1 month ago by  Seth Shoultes. Reason: Moving to premium forums


Chris

September 17, 2012 at 2:59 pm

6 Scan Pro didn’t find anything like this. I’m linking it here but I don’t recommend getting it.
http://6scan.com/features

I’m thinking you have some mal-formed code in there. Also try this scanner;
http://sitecheck.sucuri.net/scanner/

It could be in a external file, Sucuri lists the links.


Seth Shoultes

  • Support Staff

September 17, 2012 at 5:02 pm

@Khalifa Alshammiry Looks like the security scan is failing because of the SQL error that is being displayed on your site. Most like the error is being displayed because the scanner is not passing the required post vars to register an attendee or you are running an outdated version of Event Espresso and it cannot retrieve the question groups from the database.


Khalifa Alshammiry

September 17, 2012 at 9:33 pm

@ Chris:Thank you for your support. I’ll try that scanner too

@seth: It’ cant be a outdated version as we purchased and installed the pro version about 2 weeks back (version 3.1.26.p). According to you there is Sql error. As we didn’t handle any sql statement it should be due to error from the plugin.. is that right? can you tell me how to fix this.
Thank you


Seth Shoultes

  • Support Staff

September 17, 2012 at 10:14 pm

Not sure. Since you are using a new version, you shouldn’t be getting that error, unless maybe something is not set up correctly in your event. If that was the case, you would see it on the front-end of the website. Honestly, I think that the scanner may not be passing the required information to whatever files it is scanning, therefore it is showing an SQL error. In that case the SQL error that is displayed is not a bug and is there by design (using the WordPress $wpdb->show_errors() class) to show what is wrong so that a developer can fix it. It is not showing any secure data or database access information.


Khalifa Alshammiry

October 24, 2012 at 10:31 am

Hi,
I’m still having the same issue about failure in the security scanner. Issue is not solved yet. Can somebody from plugin development team help me on this
Thank you,


Chris Reynolds

  • Support Staff

November 4, 2012 at 10:13 am

@Khalifa Seth is the original author of Event Espresso and one of the lead project managers and developers on the project. It sounds like you have a couple different issues that are fighting with each other. The first seems to be that the database tables were not created successfully. We have seen countless database issues in the past on GoDaddy shared servers so, honestly, this doesn’t surprise me at all. It is for this reason that we have a note on our requirements page that Event Espresso may not work properly on GoDaddy serves.

The second issue is the security issue. This is also fairly common as GoDaddy is often targeted and made vulnerable to malicious scripts. These scripts can inject code into your wp-config.php file, plugin files, theme files, as well as creating new files throughout your installation. Some of these files could be picked up by automated scanners, but — having worked through many of these in the past personally — that’s not always the case. The best solution is to wipe all the WordPress files and do a completely fresh install and reupload/install all your plugins or manually go through every directory to see if there is anything out of place. In the second option, you’ll want to manually check your wp-config.php file and your theme’s functions.php file to see if there is any bas64-encoded or other unrecognized code in there. I would also recommend moving away from GoDaddy to one of our recommended providers due to these (and other) issues.

The support post ‘Security Scanner fails & sayin website is vulnerable to SQL injection attacks.’ is closed to new replies.

Have a question about this support post? Create a new support post in our support forums and include a link to this existing support post so we can help you.

Support forum for Event Espresso 3 and Event Espresso 4.
Documentation for EE3 and EE4
Documentation for Event Espresso 3 Documentation for Event Espresso 4

Status: closed

Updated by  Chris Reynolds 7 years, 11 months ago ago

Topic Tags

Notifications

This topic is: not resolved
Do NOT follow this link or you will be banned from the site!
[gravityform id=80 title=false description=false ajax=false]
<div class='gf_browser_unknown gform_wrapper' id='gform_wrapper_80' ><form method='post' enctype='multipart/form-data' id='gform_80' action='/topic/security-scanner-fails-sayin-website-is-vulnerable-to-sql-injection-attacks/'> <div class='gform_body'><ul id='gform_fields_80' class='gform_fields top_label form_sublabel_below description_below'><li id='field_80_1' class='gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible' ><label class='gfield_label' for='input_80_1' >First name<span class='gfield_required'>*</span></label><div class='ginput_container ginput_container_text'><input name='input_1' id='input_80_1' type='text' value='' class='medium' aria-required="true" aria-invalid="false" /></div></li><li id='field_80_2' class='gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible' ><label class='gfield_label' for='input_80_2' >Email address<span class='gfield_required'>*</span></label><div class='ginput_container ginput_container_email'> <input name='input_2' id='input_80_2' type='email' value='' class='medium' aria-required="true" aria-invalid="false" /> </div></li><li id='field_80_3' class='gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible' ><label class='gfield_label' >GDPR Agreement<span class='gfield_required'>*</span></label><div class='ginput_container ginput_container_checkbox'><ul class='gfield_checkbox' id='input_80_3'><li class='gchoice_80_3_1'> <input name='input_3.1' type='checkbox' value='I consent to have this website store my submitted information so they can respond to my inquiry.' id='choice_80_3_1' /> <label for='choice_80_3_1' id='label_80_3_1'>I consent to have this website store my submitted information so they can respond to my inquiry.</label> </li></ul></div></li><li id='field_80_4' class='gfield gform_validation_container field_sublabel_below field_description_below gfield_visibility_visible' ><label class='gfield_label' for='input_80_4' >Comments</label><div class='ginput_container'><input name='input_4' id='input_80_4' type='text' value='' autocomplete='off'/></div><div class='gfield_description' id='gfield_description_80_4'>This field is for validation purposes and should be left unchanged.</div></li> </ul></div> <div class='gform_footer top_label'> <input type='submit' id='gform_submit_button_80' class='gform_button button' value='Download Now' onclick='if(window["gf_submitting_80"]){return false;} if( !jQuery("#gform_80")[0].checkValidity || jQuery("#gform_80")[0].checkValidity()){window["gf_submitting_80"]=true;} ' onkeypress='if( event.keyCode == 13 ){ if(window["gf_submitting_80"]){return false;} if( !jQuery("#gform_80")[0].checkValidity || jQuery("#gform_80")[0].checkValidity()){window["gf_submitting_80"]=true;} jQuery("#gform_80").trigger("submit",[true]); }' /> <input type='hidden' class='gform_hidden' name='is_submit_80' value='1' /> <input type='hidden' class='gform_hidden' name='gform_submit' value='80' /> <input type='hidden' class='gform_hidden' name='gform_unique_id' value='' /> <input type='hidden' class='gform_hidden' name='state_80' value='WyJbXSIsIjBiNjdjZjkyMDUzOWUxOWY5Y2NiZjIwMzM4YjA1Mjk4Il0=' /> <input type='hidden' class='gform_hidden' name='gform_target_page_number_80' id='gform_target_page_number_80' value='0' /> <input type='hidden' class='gform_hidden' name='gform_source_page_number_80' id='gform_source_page_number_80' value='1' /> <input type='hidden' name='gform_field_values' value='' /> </div> </form> </div><script type='text/javascript'> jQuery(document).bind('gform_post_render', function(event, formId, currentPage){if(formId == 80) {} } );jQuery(document).bind('gform_post_conditional_logic', function(event, formId, fields, isInit){} );</script><script type='text/javascript'> jQuery(document).ready(function(){jQuery(document).trigger('gform_post_render', [80, 1]) } ); </script>
[i]
[i]