topic Re: SQL Injection Lilupophilupop (Part 2) in General Topics

SQL Injection Lilupophilupop (Part 2)

dciccone — Thu, 09 Aug 2012 13:42:18 GMT

Hi, recently a famous SQL Injection has started up once more.

Will there be a vulnerability signature update which includes this new version of the Lilupophilupop SQL Injection code?

More information can be found at ISC Diary | SQL Injection Lilupophilupop style, Part 2

-Dan

Re: SQL Injection Lilupophilupop (Part 2)

mikand — Mon, 20 Aug 2012 22:23:17 GMT

You can request app enhancement from the Apps and Threats Research Center.

http://www.paloaltonetworks.com/researchcenter/tools/

From there you can click on Submit an app and provide details there.

I think the above can also be used to suggest new/updated threatid's (in case the threat team somehow missed it).

Re: SQL Injection Lilupophilupop (Part 2)

SRA — Wed, 05 Sep 2012 21:41:40 GMT

This link is only for submitting new application requests. For threat coverage, check out the threat vault or open a case with support for a new threat.

Re: SQL Injection Lilupophilupop (Part 2)

fredallee — Wed, 05 Sep 2012 21:58:33 GMT

We normally don't write signatures for specific URLs that end up getting inserted via SQL injection attacks, unless they are exceptionally pervasive. These are everywhere and it is impossible to cover them all. Instead we have generic SQL injection signatures that can detect many common SQL injection attempts, and customers can also write custom vulnerability signatures for specific SQL injection attacks that you may be concerned about.