False positive on Cyrillic input 942120 (PL2) #823
Description
This is a different rule from #794 although the mechanism is comparable.
Input: name=%D1%81%D0%B5%D1%80%D0%BF+%D0%B8+%D0%BC%D0%BE%D0%BB%D0%BE%D1%82
Decoded: серп и молот
Result: Matched Data: <> found within ARGS:name: A5@? 8 <>;>B
Log: Message: Warning. Pattern match "(?i:(\\!\\=|\\&\\&|\\|\\||>>|<<|>=|<=|<>|<=>|\\bxor\\b|\\brlike\\b|\\bregexp\\b|\\bisnull\\b)|(?:not\\s+between\\s+0\\s+and)|(?:is\\s+null)|(like\\s+null)|(?:(?:^|\\W)in[+\\s]*\\([\\s\\d\"]+[^()]*\\))|(?:\\bxor\\b|<>|rlike(?:\\s+binary)?)|(?:regexp\\s+ ..." at ARGS:name. [file "/usr/local/etc/apache24/security2/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "526"] [id "942120"] [rev "3"] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: <> found within ARGS:name: A5@? 8 <>;>B"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"]
The problem is %D0%BC%D0%BE getting decoded to <>.