0

I'm currently using Joomla and we have a small security vulnerability in our URI. Currently, it displays the Exception/Error directly to the user like so:

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line

Which is providing useful information to users who may attempt a SQL injection attack.

How would I force all exceptions/errors to redirect to the home page? This error can only happen if someone directly manipulates the URI and not through clicking the page.

If it helps, I believe this problem is caused by a component we're using that's directly querying with the URI instead of using prepared statements, but I can't seem to pinpoint where it is.

1
  • Welcome to JSE. Please take the tour while you wait for responses to your question.
    – mickmackusa
    Sep 24, 2019 at 2:19

1 Answer 1

0

I am assuming that when you get the error and the processing stops and as such I don't believe it is possible to be redirected anywhere. Better error handling code around the data base query might overcome this by allowing processing to continue.

If you have Error Reporting set to None in your Global Configuration, it should be suppressing those messages to the end user and processing should still continue, maybe enough to display a page that you can trap and redirect via Joomla or .htaccess if you are on Apache.

If you want to get more information about what is creating the error then set Error Reporting to something like Maximum or Development for a short time while you try to diagnose where the issue is coming from.

4
  • Looks like setting it to development/maximum did not change the error that's displayed. Is there some way for me to figure out exactly what line in which file is throwing the SQL error? The error text is very... vague.
    – butter
    Sep 24, 2019 at 8:17
  • Did you also have Debug set to Yes?
    – Irata
    Sep 24, 2019 at 13:23
  • Just set it to Yes for Debug system & Debug language. Still getting that very generic SQL syntax error.
    – butter
    Sep 25, 2019 at 1:27
  • Can you provide a link to site where it is happening and the steps required to recreate it? Do you have access to the error logs for Maria, PHP, Joomla or your server?
    – Irata
    Sep 25, 2019 at 3:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.