Forum Discussion

Sergio_Magra's avatar
Sergio_Magra
Icon for Nimbostratus rankNimbostratus
Feb 19, 2013

Filename is seeing as parameter and applied a SQL Injection signature

Hi, the ASM (9.4.4) have a false positive by detecting the filenames as parameter and applying the following SQL injection signature:   False Positive: SQL-INJ "--" (SQL comment) (Parameter)   ...
APM
app sec
security
Torti's avatar
Torti
Icon for Altostratus rankAltostratus
Feb 21, 2013
Hi,

 

 

why contains the parameter filename the complete path? It should only contain the name.

 

How is the detailed violation?

 

Shouldn't be 'file1' the binary?

 

 

Yes, you can set filename as parameter, to disable signature scanning. Then, only some base signatures are scanned.

 

But you cannot disable the complete signature scanning for a single parameter.