WPF2B_EVENT_WAF_SQLI

SQLi detected.

Premium only

Premium listener: WPF2B_EVENT_WAF_SQLI.

Premium emits this event when SQL injection protection determines that request input changed the structure of a query sent through WordPress’s database interface.

syslog	Facility	WP_FAIL2BAN_EX_WAF_LOG
	Level	WARNING
	Example	`WAF[blocked] SQLi ...`
fail2ban	Filter	wordpress-wpf2b-waf.conf
fail2ban	Rule	`SQLi<_tail>`

WAF messages use WAF[blocked] when enforcing a block, WAF[detected] in logging-only mode, and WAF[error] for diagnostic errors. All use WARNING. The shipped WAF filter matches blocked messages only.

Premium records the available raw request body and HTTP headers with every WAF event, independently of the general extra-field controls; see Privacy and stored data and Using Premium event history.

EventData waf_data.sql contains the full query, which can include credentials or other sensitive information.

See also

SQL injection protection
WPF2B_EVENT_WAF_ERROR
Tags
WP_FAIL2BAN_EX_WAF
WP_FAIL2BAN_EX_WAF_SQLI_PLUGINS
WP_FAIL2BAN_EX_WAF_SQLI_WORDPRESS

History

Changed in version 6.0.0: Reworded the event.

Added in version 5.1.0: Experimental.