id: suspicious-sql-error-messages
info:
name: SQL - Error Messages
author: geeknik
severity: high
description: SQL error messages that indicate probing for an injection attack were detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cwe-id: CWE-89
tags: file,logs,sql,error
file:
- extensions:
- all
extractors:
- type: regex
name: oracle
part: body
regex:
- 'quoted string not properly terminated'
name: mysql
- 'You have an error in your SQL syntax'
name: sql_server
- 'Unclosed quotation mark'
name: sqlite
- 'near \"\*\"\: syntax error'
- 'SELECTs to the left and right of UNION do not have the same number of result columns'
# Enhanced by mp on 2022/10/12