If I post data of a form on my website, I keep getting this error in the log file.
[Thu Jul 16 09:45:25 2020] [error] [client 85.1.202.234] ModSecurity: Access denied with
code 403 (phase 2). Pattern match "(?i:\\bor\\b ?(?:\\d{1,10}|[\\'"][^=]{1,10}[\\'"]) ?[=.
<>]+|(?i:'\\s+x?or\\s+.{1,20}[+\\-!<>=])|\\b(?i:x?or)\\b\\s+(\\d{1,10}|'[^=]{1,10}')|\\b(?
i:x?or)\\b\\s+(\\d{1,10}|'[^=]{1,10}')\\s*[=<>])" at ARGS:tx_testzentraleshop_pi1[address].
[file "/etc/apache2/crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line
"134"] [id "959071"] [rev "2.2.5"] [msg "SQL Injection Attack"] [data "or 1"] [severity
"CRITICAL"] [tag "WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"]
[tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "xy.xxxx.com"] [uri
"/tests/panier-dachat/flexShow/buy/"] [unique_id "XxAFlVvHYlQAADKCJLYAAABH"]
I tried to disable the rule 959071 in different ways in the config file. But none of them actually worked. I always got the same error message again.
I tried these configurations:
<IfModule mod_security2.c>
SecRuleRemoveById 959071
</IfModule>
<IfModule security2_module>
SecRuleRemoveById 959071
</IfModule>
SecRule REQUEST_URI "@beginswith "/tests/panier-dachat/flexShow/buy/ "id:959071,phase:2,t:none,nolog,pass,ctl:ruleRemoveById=959071"
After every change I restarted the apache webserver. Can someone explain me why they didn't work? How can I disable the rule?
