What this bot/IP trying to do on my civicrm site?

Question

I find 100s of these types of entries in my drupal log. It tries URLs like this below. It happens when there's very less traffic on our site. What is it trying to do? Is it a security threat? Can it cause any harm to our site & data? Can they be stopped?

https://example.com/civicrm/contribute/transact?reset=1%27%20AND%206876%20IN%20%28SELECT%20%28CHAR%28113%29%2BCHAR%28106%29%2BCHAR%2898%29%2BCHAR%28122%29%2BCHAR%28113%29%2B%28SELECT%20%28CASE%20WHEN%20%286876%3D6876%29%20THEN%20CHAR%2849%29%20ELSE%20CHAR%2848%29%20END%29%29%2BCHAR%28113%29%2BCHAR%28118%29%2BCHAR%28106%29%2BCHAR%28112%29%2BCHAR%28113%29%29%29%20AND%20%27KFmQ%27%3D%27KFmQ&id=10

Answer 1

It's a SQL injection attempt, where it's looking to see if it gets used in a query and alters it. Depending on the query where it gets used, it could do nothing or it could do something, but at the very least tells the attacker if it's vulnerable. Simple example, where it does nothing:

If civi had code like this, where it doesn't escape the value:

$reset = $_GET['reset'];
$dao = CRM_Core_DAO::executeQuery("SELECT * FROM table WHERE something='$reset'");

That particular url would translate to:

$reset = $_GET['reset'];
$dao = CRM_Core_DAO::executeQuery("SELECT * FROM table WHERE something='1' AND 6876 IN (SELECT (1)) AND 'KFmQ'='KFmQ'");

which is valid SQL and does something different than intended. In my example all it does is tell the attacker it's vulnerable, but there's lots of variations.

Since IDS is catching it, you get the log errors.

If it's always the same IP, you can block the IP.