Hi,

I am using Aperia Solutions for PCI scan and I am getting Blind SQL injection in mojoPortal code.

We have tried all possible solutions available but could not find solution. Could you please help us in this regard?

Hi Joe,

I did some research and I found that they have reproduced this issue on IE 7 and OS is vista. This is a charset vulnerability
It happens when a browser assumes a page is UTF-7 almost all modern browsers assume UTF-8 so this is a vulnerability that occurs only in old browsers you can't reproduce it if you use a modern browser. I tried to reproduce this issue on IE 7 and found one problem.

I am aware that mojoPortal add meta tag <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> but this is after title tag. As per the solution available on internet to fix Blind SQL injection issue we should add charset = utf-8 before title tag. So we added <meta charset="utf-8"> in my layout.master page of my skin folder. And after doing some analysis we found two issues:

• Though we didn't add end tag but still in view source it is displayed as <meta charset="utf-8" />. So I think this could be an issue since old browsers(IE 8 and below) do not ignore this end tag and hence it is considering it as incorrect syntax. I am not sure why this end tag is added.
• In browsers IE 8 and below meta tag is displayed below title tag even though we added above title tag.

Can you please help us in this regard.

Sorry for the confusion but issue was reported by Aperia Solutions as Blind SQL injection issue after my research I found that it is something related to charset vulnerability. I have stared another thread for charset vulnerability.