Suspecious query being logged and causing website going down

Hi,

These searches where badly affecting our website as these queries keep running and never end. And this was inducing heavy load and mysql stop responding.

1) Blocked searches with special characters. Allowed only characters:
A-Z, a-z, 0-9, space , dot, hyphen, plus

2) Maximum length setup for search: 18 characters
If any of the above is violated it returns empty results.

3) Disabled all other languages in search other than English in search.

Is this a common problem with Opencart? Is there some fixes for this in the newer versions?

Just a quick thought: What if you checked for the number of search requests having originated from the requesting IP-address for a given short time period, and if exceeded, start returning 403 responses for the remaining session? This might help to deter the SQL injection requester quickly.

nisamudeen97 wrote: ↑

Thu Aug 14, 2025 12:13 am

Is this a common problem with Opencart? Is there some fixes for this in the newer versions?

1. It is coming from an extension not Opencart
2. Spam is not an ‘issue’ with Opencart - it is a global problem
3. SQL injections are not an ‘issue’ with Opencart, but vulnerabilities in global software, errors and extensions and outdated software etc can be related, but there is rarely a ‘fix’. Generally Opencart is very secure as default.
4. Hacking is not an ‘issue’ with Opencart .. brute force attacks .. bots .. the list continues ..

Having ANYTHING online or connected to something that is online is vulnerable to exploitation …

That said .. yes you were advised to upgrade to 3.0.4.1 and php8.
It does not answer you question but it is related. For security reasons EVERYONE needs to upgrade to php8 and Opencart 3.0.4.1 supports it.

by mona wrote: ↑

Thu Aug 14, 2025 2:55 am

nisamudeen97 wrote: ↑

Thu Aug 14, 2025 12:13 am

Is this a common problem with Opencart? Is there some fixes for this in the newer versions?

For security reasons EVERYONE needs to upgrade to php8 and Opencart 3.0.4.1 supports it.

And also server side will always play a role into it, you can have an excellent written extension/code but if your server allows manipulation on it then you are essentially leaving the door unlocked — poor server configuration, outdated software, or weak permissions can let attackers bypass even the best application code. Security is a chain, and the weakest link — whether code or server — will always be the point of compromise.

khnaz35 wrote: ↑

Wed Aug 13, 2025 5:51 pm

While they are not trying to inject some data into system but they still eating up system resources. And yes they are automated otherwise why someone human on site of ecommerce is trying to search YouTube videos, Facebook ads etc??

So yes its a Spam bot/boy-driven attack.

Those are peanut queries, eating zero resources.

nisamudeen97 wrote: ↑

Thu Aug 14, 2025 12:13 am

Hi,

These searches where badly affecting our website as these queries keep running and never end. And this was inducing heavy load and mysql stop responding.

1) Blocked searches with special characters. Allowed only characters:
A-Z, a-z, 0-9, space , dot, hyphen, plus

2) Maximum length setup for search: 18 characters
If any of the above is violated it returns empty results.

3) Disabled all other languages in search other than English in search.

Is this a common problem with Opencart? Is there some fixes for this in the newer versions?

1) that is good
2) also good
3) no need when you make that "smartsearch" extension multibyte compatible which it should be from the start as it handles global external input.

nonnedelectari wrote: ↑

Thu Aug 14, 2025 9:21 pm

khnaz35 wrote: ↑

Wed Aug 13, 2025 5:51 pm

While they are not trying to inject some data into system but they still eating up system resources. And yes they are automated otherwise why someone human on site of ecommerce is trying to search YouTube videos, Facebook ads etc??

So yes its a Spam bot/boy-driven attack.

Those are peanut queries, eating zero resources.

Do you even understand here the statement?

khnaz35 wrote: ↑

Thu Aug 14, 2025 9:33 pm

nonnedelectari wrote: ↑

Thu Aug 14, 2025 9:21 pm

khnaz35 wrote: ↑

Wed Aug 13, 2025 5:51 pm

While they are not trying to inject some data into system but they still eating up system resources. And yes they are automated otherwise why someone human on site of ecommerce is trying to search YouTube videos, Facebook ads etc??

So yes its a Spam bot/boy-driven attack.

Those are peanut queries, eating zero resources.

Do you even understand here the statement?

yes, your response at posting.php?mode=quote&p=880587 was correct, your mod_security was overkill and the rest was irrelevant.

Still, that search extension is not multibyte compliant which is bad for an extension accepting global user input.

nonnedelectari wrote: ↑

Thu Aug 14, 2025 10:03 pm

your mod_security was overkill and the rest was irrelevant.

You can always adjust on base of your needs, since this is forum so we people here don't know what kind of setup & server stack you are using or what are your capabilities when dealing with threats.

nonnedelectari wrote: ↑

Thu Aug 14, 2025 10:03 pm

Still, that search extension is not multibyte compliant which is bad for an extension accepting global user input.

As for the extension not being complaint you can write to developer and sort it out.

With that said this issue is resolved and feel free to mark it solved