1

on CiviCRM 4.5.4 on Drupal, PCI vendor is reporting errors along the lines of:

Using the GET HTTP method, XYZ found that : + The following resources may be vulnerable to blind SQL injection : + The 'snippet' parameter of the /civicrm/mailing/subscribe CGI : /civicrm/mailing/subscribe? mark_x_2=1&recaptcha_response_field=manual_ch allenge&recaptcha_challenge_field=&qfKey=03baf253d7e24b62a4d8b8e76939c 36 3_6657&mark_x_45=1&_qf_Subscribe_cancel=Cancel&_qf_Subscribe_next=Subs cr ibe&_qf_default=Subscribe%3anext&email=Email%20Sign-

In addition there are a number of other parameters they report, like "recaptcha_response_field", "recaptcha_challenge_field", "qfKey", "mark_x_45", and others.

I'm fairly certain this is a false positive, but need some justification.

Thank you!

  • As Karin points out, your PCI auditor is correct - there have been many CiviCRM security updates since 4.5.4 including several SQL injection issues, and you should upgrade ASAP to secure your contacts' data. Check the CiviCRM docs for upgrade documentation, and make sure to test thoroughly before upgrading your live site. You are very welcome to send your audit report to security@civicrm.org in case some new issue has been identified. – Chris Burgess Jun 29 '16 at 5:09
  • 1
    If you administer a CiviCRM site, I recommend subscribing to the advisories which are sent out by email when a new security release is made. civicrm.org/receive-security-advisories – Chris Burgess Jun 29 '16 at 5:11
  • Good idea I'm going to subscribe to that, thanks. – nocabt Jun 30 '16 at 20:16
2

CiviCRM 4.5.x branch has stopped receiving security updates a very long time ago. Best to upgrade to 4.6.x or 4.7.x as soon as possible!

If you need help - find a partner near you in the partner listings: https://civicrm.org/partners-contributors

  • Upgrades can be daunting - but they don't have to be - if you've never hacked your CiviCRM and have never made schema changes to its table structure - then you'll likely be ok; you may just have to review custom_php files (if you have them) and extensions; – KarinG - Semper IT Jun 30 '16 at 17:26
  • Yeah, unfortunately for this site there are a TON of customizations as you mention and custom extensions that would make it a bit of a bear... THANK YOU though! – nocabt Jun 30 '16 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.