I'm currently investigating SQL injection attack vectors in my application. Currently, Joomla is reporting database error output when returning a HTTP 500 error page. How do I prevent this?
The display_errors
setting is disabled in php.ini (though I am generally assuming this is not so relevant for error pages resulting from MySQL errors anyway?), and I have set 'Error Reporting' to 'None' in the Joomla Server Settings page, yet I still get the error being reported. Example error output is below.
1062 - Duplicate entry '!~!my_db!~!1' for key 'group_key' SQL=SELECT id, component, view, layout, task, field, link, content FROM
#__hint_text WHERE (component = 'com_mycomponent' OR component = '*') AND (view = 'someview' and(/**/sElEcT 1 /**/fRoM(/**/sElEcT count(*),/**/cOnCaT((/**/sElEcT(/**/sElEcT /**/cOnCaT(0x217e21,/**/dAtAbAsE(),0x217e21)) /**/fRoM information_schema./**/tAbLeS /**/lImIt 0,1),floor(rand(0)*2))x /**/fRoM information_schema./**/tAbLeS /**/gRoUp/**/bY x)a) and '1'='1' OR view = '*') AND (layout = '' OR layout = '*' OR layout IS NULL)
To be clear, I don't need advice on how to fix SQL injection attack vectors in my code - I just want to know how to prevent Joomla from revealing information where I may have a yet undetected coding error.