I find 100s of these types of entries in my drupal log. It tries URLs like this below. It happens when there's very less traffic on our site. What is it trying to do? Is it a security threat? Can it cause any harm to our site & data? Can they be stopped?


enter image description here

1 Answer 1


It's a SQL injection attempt, where it's looking to see if it gets used in a query and alters it. Depending on the query where it gets used, it could do nothing or it could do something, but at the very least tells the attacker if it's vulnerable. Simple example, where it does nothing:

If civi had code like this, where it doesn't escape the value:

$reset = $_GET['reset'];
$dao = CRM_Core_DAO::executeQuery("SELECT * FROM table WHERE something='$reset'");

That particular url would translate to:

$reset = $_GET['reset'];
$dao = CRM_Core_DAO::executeQuery("SELECT * FROM table WHERE something='1' AND 6876 IN (SELECT (1)) AND 'KFmQ'='KFmQ'");

which is valid SQL and does something different than intended. In my example all it does is tell the attacker it's vulnerable, but there's lots of variations.

Since IDS is catching it, you get the log errors.

If it's always the same IP, you can block the IP.

  • Thanks for explaining. Is there a way to automatically/programmatically block this kind of multiple number of attempt within a short period of time? It appears that they change their IP or user VPN for this kind of activity.
    – Tapash
    Commented May 8, 2020 at 22:11
  • 1
    You could do it at the web server level, e.g. in apache in httpd.conf or .htaccess drop the request if it matches a pattern, so it doesn't even reach drupal.
    – Demerit
    Commented May 8, 2020 at 22:18
  • Great tips. Thanks a million!
    – Tapash
    Commented May 9, 2020 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.