[JimtownSteve]

I use Wordfence security plugin and received this security alert:

Blocked for SQL Injection in POST body: message=Hi Vic,\x0a\x0aI made a change on the Email Alerts page for emailing town government. The name link used t\xea

The message=text was written in an email contact form from Connections using the Names template. I wrote Wordfence about this and they said:

I would not immediately suspect that this means you were hacked or have a vulnerability. The “\x0a\x0aI” looks like two line feeds encoded in hex. So what this means is that the code that is sending the email is not interpreting your line feeds correctly. Then Wordfence blocks the request because it doesn’t like when it sees hex code in a “POST” field (that is a typical behavior from hackers).

So what you may want to do is to contact the authors of that plugin and ask them why the line feeds are coded as hex.

I believe the alert will be generated every time a message is sent to a contact. Is there a change that can be made to prevent false positive security alerts?

[Steven Zahm]

@ JimtownSteve

So, this was a message “caught” being sent using the Contact form? If it is, nothing in the encodes the message in HEX. Perhaps someone copy/pasted the text from another source which already had the text HEX encoded.

The message body is run through the core WordPress sanitize_text_field() function, it could be possible that another plugin added a filter to this function which is doing the HEX encoding.

Have you tried sending other test messages thru Contact? Do they also get flagged by WF?

[JimtownSteve]

Hi Steven,

I’m pretty sure that the message was sent with with the Connections contact form. To be honest, the dependencies are a bit confusing to me. I can tell you that I’m using the “Connections: List” widget in the sidebar and when a contact is clicked an email form comes up with information about the person from Connections.

I wrote the message that I asked about and there was no copy and paste. But I’ll also do some more testing as you suggested now that I’m past the alarm of getting the Wordfence alert. I didn’t want to do any more in case there was a serious security issue but from what you and Wordfence said it appears there isn’t.

Steve

[Steven Zahm]

@ JimtownSteve

Ok, yes, it seems to be a false positive. How the text from the message box is getting HEX encoded though is a mystery. I’d have to exactly where WF checks the email message. My best guess is they might be replacing the core wp_mail() function (since it is pluggable) and running the security checks in their replacement.

If you find this is happens with every sent message, as WF support where exactly that error is triggered and let me know that way I can help track down why the HEX encoding is occurring and offer a fix.

[JimtownSteve]

Will do. Thanks for your help.

[Author]

Posts