OWASP ModSec CRS Paranoia Mode Sibling 970003

This page contains a proposal for a stricter rule-clone for ModSecurity CRS Paranoia Mode.

970003 : SQL Error Leakage
# # -=[ SQL Error Leakage ]=- # # This is a paranoid sibling to 2.2.9 Rule 970003. # The rule now triggers the anomaly scoring instantly # instead of just setting tx.sql_error_match. # SecRule RESPONSE_BODY "@pmFromFile sql-errors.data" \ "phase:response,\       id:XXXXXX,\        rev:'5',\        ver:'OWASP_CRS/3.0.0',\        pass,\        nolog,\        tag:'application-multi',\        tag:'language-multi',\        tag:'platform-multi',\        tag:'attack-information disclosure',\        setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\        t:none"