OWASP ruleset vs XSS/SQL Injection

Databases
1

Hello,

i have enabled OWASP modesecurty in our WHM Server.
then i tested the functionality with a website hosted in our server using the following sql statemnt.

a' union sElEcT 1,2,table_nAme fRom informAtion_schemA.tAbles WhErE tablE_scHemA=dAtabase()-- -

406 Not acceptable - mean rule in action.

a'/**//*!unIoN*//**//*!SelEct*//**/1,/*!table_name*/,database()/**/from/**/information_schema.tables/**/WheRe/**/tablE_SchEma=daTabase()--+-

successflly got in - rule set failed.

What could be wrong :mad::mad:

2

any body pls!

3

I’m guessing this is with MySQL?

If nobody comes by with OWASP modsecurity knowledge soon we could try moving the thread to the database forum.

4

yes mitti, will try like that then.

5

Moved to the database forum, Hopefully someone can help you put together a rule.