on CiviCRM 4.5.4 on Drupal, PCI vendor is reporting errors along the lines of:

Using the GET HTTP method, XYZ found that : + The following resources may be vulnerable to blind SQL injection : + The 'snippet' parameter of the /civicrm/mailing/subscribe CGI : /civicrm/mailing/subscribe? mark_x_2=1&recaptcha_response_field=manual_ch allenge&recaptcha_challenge_field=&qfKey=03baf253d7e24b62a4d8b8e76939c 36 3_6657&mark_x_45=1&_qf_Subscribe_cancel=Cancel&_qf_Subscribe_next=Subs cr ibe&_qf_default=Subscribe%3anext&email=Email%20Sign-

In addition there are a number of other parameters they report, like "recaptcha_response_field", "recaptcha_challenge_field", "qfKey", "mark_x_45", and others.

I'm fairly certain this is a false positive, but need some justification.

Thank you!

  • As Karin points out, your PCI auditor is correct - there have been many CiviCRM security updates since 4.5.4 including several SQL injection issues, and you should upgrade ASAP to secure your contacts' data. Check the CiviCRM docs for upgrade documentation, and make sure to test thoroughly before upgrading your live site. You are very welcome to send your audit report to [email protected] in case some new issue has been identified. Commented Jun 29, 2016 at 5:09
  • 1
    If you administer a CiviCRM site, I recommend subscribing to the advisories which are sent out by email when a new security release is made. civicrm.org/receive-security-advisories Commented Jun 29, 2016 at 5:11
  • Good idea I'm going to subscribe to that, thanks.
    – nocabt
    Commented Jun 30, 2016 at 20:16

1 Answer 1


CiviCRM 4.5.x branch has stopped receiving security updates a very long time ago. Best to upgrade to 4.6.x or 4.7.x as soon as possible!

If you need help - find a partner near you in the partner listings: https://civicrm.org/partners-contributors

  • Upgrades can be daunting - but they don't have to be - if you've never hacked your CiviCRM and have never made schema changes to its table structure - then you'll likely be ok; you may just have to review custom_php files (if you have them) and extensions; Commented Jun 30, 2016 at 17:26
  • Yeah, unfortunately for this site there are a TON of customizations as you mention and custom extensions that would make it a bit of a bear... THANK YOU though!
    – nocabt
    Commented Jun 30, 2016 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.