SQL injection attack on a PostgreSQL database (t_jiaozhu)

A web server running Apache 2 and PostgreSQL was successfully compromised using a SQL injection vulnerability. I first noticed there was a new table in one of our PostgreSQL databases named 't_jiaozhu'.

public t\_jiaozhu table postgres

The table was not something we created. First I googled for the term 't_jiaozhu' and found that there was only one English result that mentioned SQL injection attacks with the previously mentioned table name. At this point we searched the PostgreSQL log files but after some research, found the attacker's query in the Apache logs:

# grep t\_jiaozhu \*fred-access\_log:219.153.131.99 - - [25/Mar/2007:11:59:32 -0400] "HEAD /showemploymentopportunity.php?id=38;create%20table%20t\_jiaozhu(jiaozhu%20varchar(200)) HTTP/1.1" 200 - "-" "Mozilla/3.0 (compatible; Indy Library)"

"After the table was created, there were several hits from that IP that had the following user agent "Mozilla/3.0 (compatible; Indy Library)". A little digging shows that it might be a Chinese spambot."

It was determined that input variables were not being checked.

if (!is\_numeric($id)) $id = 0;