possible SQL injection in Biblio via order-by

Hmm... this explains much about a site from which I recently removed the biblio module.

E

Fixed in rc6

@aitala - do you mean that you believe the site was attacked via sql injection?

I was testing the biblio module and never made it publicly available. Once I disabled and removed it, I noticed a number of 'page not found' errors from anonymous user trying to access it. Seems odd to me...

E

@aitala - did the "page not found" errors have odd parameters that looked like sql injection? Those would be something like "DESC UNION NEW QUERY STATEMENT HERE;" or "DESC; NEW QUERY STATEMENT HERE;" so they would be pretty obvious as sql injection.

@greggles - No, but they did appear to be doing a sort or an order at the Drupal level. If I had seen any SQL, I would have known there was a hack attempt. It looked to be more of a probe than anything else.

The site in question was in Wordpress (over a year ago) , but I still see attempts to get at the WP login/signup pages. And the site gets very little traffic so I gather it got on some sort of 'Attack Me' list somewhere.

E

I gather it got on some sort of 'Attack Me' list somewhere.

Unfortunately that seems to be every domain and every IP on the internet ;) In my experience, automated bots/spiders (whether malicious or not) start probing sites within days of their existence and never seem to stop.