Clash with Mod_Security - Causing HTTP Response Splitting Attack about securimage HOT 3 CLOSED

Securimage doesn't generate any URLs with %0a or %0d in them so most likely its just a bot or vulnerability scanner hitting those URLs on your site with one of those values in it, but the warnings logged aren't caused by Securimage.

The IP address shown above belongs to this company: http://www.kdmanalytics.com/kdma/index.html

If they shouldn't be testing your server, contact their ISP (primus.ca) to file an abuse report.

from securimage.

Thanks for looking into this issue Drew. However, the form has been
unchanged for 4+ years until I added daphp imagesecure to it, then the
problems started occurring :-(

Joshua

On 2012-10-31 17:02, Drew
Phillips wrote:

Securimage doesn't generate any URLs with %0a or %0d
in them so most likely its just a bot or vulnerability scanner hitting
those URLs on your site with one of those values in it, but the warnings
logged aren't caused by Securimage.

The IP address shown above
belongs to this company: http://www.kdmanalytics.com/kdma/index.html [1]

If they shouldn't be testing your server, contact their ISP
(primus.ca) to file an abuse report.

Reply to this email
directly or view it on GitHub [2].

Links:

[1]
http://www.kdmanalytics.com/kdma/index.html
[2]
#21 (comment)

from securimage.

Was mod_security added or upgraded recently? What are the access logs corresponding to those entries. They may show what the full request URI was including the malicious part. I doubt the entry posted in this log was sent by a human since it looks like that IP is doing automated scans.

from securimage.