SQL injection, lilupophilupop-style
Update/Errata: I got all excited when I saw "information_schema", hoping that this is finally something new. Turns out in my ignorance of SQL Server, I didn't realize that Microsoft SQL Server uses information_Schema as well. So this is just "yet another" SQL Injection like we have seen so many over the last few year. (and prior attacks used "information_Schema" already)
I removed the paragraph about MySQL below.
Sorry. Johannes.
(can someone please come up wiht something new and different? ;-) )
It's been a while since we published the diary about the lilupophilupop SQL injection (https://isc.sans.edu/diary.html?storyid=12127) that back in January had infected LOTS of web sites. But guess what, they are b-aaa-ck, and are trying pretty much the same thing.
which decoded looks as usual:
Searching for the injected "lasimp04risoned" URL via Google shows that bad guys don't seem to be as 'successful' with this attack as last time, but this can change. If you have additional information from your web server logs, especially also information on which server or content management system is being targeted this time, please let us know.
Thanks to ISC reader Mike for sharing the excerpt from his web logs!
Comments
www
Nov 17th 2022
6 months ago
EEW
Nov 17th 2022
6 months ago
qwq
Nov 17th 2022
6 months ago
mashood
Nov 17th 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
isc.sans.edu
Dec 26th 2022
5 months ago
isc.sans.edu
Dec 26th 2022
5 months ago