I want to submit articles with special characters but I am unable to submit articles with special characters such as quotation mark (" "), %, *, etc. in the abstract. It keeps rolling and sometimes will show forbidden error message.
When I log in as an Author, it will keep rolling when I click the save and continue button.
I use OJS 3.3.14 running on PHP 7.4 and Apache 2.4.
Please someone should help me out or point to me where this issue had been solved.
.
For these types of behaviours, it is best to check your PHP error log? Are you able to do that and can provide the output of your log for here?
Thanks,
Roger
PKP Team
Below is the error log and I can see in the first line that it is a Mod security challenge or something else.
What should I do?
[Thu May 11 17:53:22.132564 2023] [:error] [pid 22972:tid 139666019837696] [client 138.199.21.208:43452] [client 138.199.21.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i:[\”\\‘][ ](([^a-z0-9~_:\\’ ])|(in)).+?\\(.?\\))" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_xss_attacks.conf”] [line “506”] [id “973335”] [rev “2”] [msg “IE XSS Filters - Attack Detected.”] [data "Matched Data: \x22), was an After-Action Review of Mobile Charge Capture (MCC) found within ARGS:abstract[en_US]: The basis of this \x22evaluation case\x22 study, which concentrated on process improvement (PI) at a Midwest United States specialty medical practice (\x22the practice\x22), was an After-Action Review of Mobile Charge Capture (MCC) software, post implementation. "] [ver “OWASP_CRS/2.2.9”] [maturity “8”] [accuracy “8”] [tag “OWASP_CRS/WEB_ATTACK/XSS”] [tag “WASCTC/WASC-8”] [tag “WASCTC/WASC-22”] [tag “OWASP_TOP_10/A2”] [tag “OWASP_AppSensor/IE1”] [tag “PCI/6.5.1”] [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/submission/saveStep/3”] [unique_id “ZF0rkuXDkv6QkpJDmf1wqQAAAMQ”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/submission/wizard/1?submissionId=14
[Thu May 11 17:57:01.496750 2023] [:error] [pid 22972:tid 139665919125248] [client 138.199.21.208:43622] [client 138.199.21.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i:[\”\\’][ ](([^a-z0-9~_:\\’ ])|(in)).+?\\(.?\\))" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_xss_attacks.conf”] [line “506”] [id “973335”] [rev “2”] [msg “IE XSS Filters - Attack Detected.”] [data “Matched Data: \x22), was an After-Action Review of Mobile Charge Capture (MCC) found within ARGS:abstract[en_US]: The basis of this \x22evaluation case\x22 study, which concentrated on process improvement (PI) at a Midwest United States specialty medical practice (\x22the practice\x22), was an After-Action Review of Mobile Charge Capture (MCC) software, post implementation. MCC is an electronic health record management tool that addresses billing, scheduling, and coding practices. Results from the SAR…”] [ver “OWASP_CRS/2.2.9”] [maturity “8”] [accuracy “8”] [tag “OWASP_CRS/WEB_ATTACK/XSS”] [tag “WASCTC/WASC-8”] [tag “WASCTC/WASC-22”] [tag “OWASP_TOP_10/A2”] [tag “OWASP_AppSensor/IE1”] [tag “PC [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/14/publications/14”] [unique_id “ZF0sbeXDkv6QkpJDmf1wywAAANA”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/14/1
[Thu May 11 19:02:19.103808 2023] [:error] [pid 22486:tid 139666112710400] [client 138.199.21.208:44510] ojs2: 404 Not Found
[Thu May 11 19:17:28.166757 2023] [:error] [pid 31901:tid 139665927517952] [client 138.199.21.208:44718] ojs2: 404 Not Found
[Thu May 11 21:15:37.597420 2023] [:error] [pid 6189:tid 140707274155776] [client 169.150.218.88:43858] [client 169.150.218.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i:[\”\\'][ ](([^a-z0-9~_:\\’ ])|(in)).+?\\(.?\\))” at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_xss_attacks.conf”] [line “506”] [id “973335”] [rev “2”] [msg “IE XSS Filters - Attack Detected.”] [data “Matched Data: '), was an After-Action Review of Mobile Charge Capture (MCC) found within ARGS:abstract[en_US]: The basis of this ‘evaluation case’ study, which concentrated on process improvement (PI) at a Midwest United States specialty medical practice (‘the practice’), was an After-Action Review of Mobile Charge Capture (MCC) software, post implementation. MCC is an electronic health record management tool that addresses billing, scheduling, and coding practices. Results from the SARS-CoV-2 pandemi…”] [ver “OWASP_CRS/2.2.9”] [maturity “8”] [accuracy “8”] [tag “OWASP_CRS/WEB_ATTACK/XSS”] [tag “WASCTC/WASC-8”] [tag “WASCTC/WASC-22”] [tag “OWASP_TOP_10/A2”] [tag “OWASP_AppSensor/IE1”] [tag “PC [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/14/publications/14”] [unique_id “ZF1a-XEvbgN7mXHTtCBHGwAAAME”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/14/5
[Thu May 11 21:15:40.919218 2023] [:error] [pid 6189:tid 140707265763072] [client 169.150.218.88:43860] [client 169.150.218.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i:[\”\\'][ ](([^a-z0-9~_:\\’ ])|(in)).+?\\(.?\\))” at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_xss_attacks.conf”] [line “506”] [id “973335”] [rev “2”] [msg “IE XSS Filters - Attack Detected.”] [data “Matched Data: '), was an After-Action Review of Mobile Charge Capture (MCC) found within ARGS:abstract[en_US]: The basis of this ‘evaluation case’ study, which concentrated on process improvement (PI) at a Midwest United States specialty medical practice (‘the practice’), was an After-Action Review of Mobile Charge Capture (MCC) software, post implementation. MCC is an electronic health record management tool that addresses billing, scheduling, and coding practices. Results from the SARS-CoV-2 pandemi…”] [ver “OWASP_CRS/2.2.9”] [maturity “8”] [accuracy “8”] [tag “OWASP_CRS/WEB_ATTACK/XSS”] [tag “WASCTC/WASC-8”] [tag “WASCTC/WASC-22”] [tag “OWASP_TOP_10/A2”] [tag “OWASP_AppSensor/IE1”] [tag “PC [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/14/publications/14”] [unique_id “ZF1a_HEvbgN7mXHTtCBHHAAAAMI”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/14/5
[Thu May 11 21:34:33.663375 2023] [:error] [pid 6189:tid 140707129968384] [client 169.150.218.88:44164] [client 169.150.218.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID-19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students’ chance to learn and develop their skill c…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/management/importexport/plugin/QuickSubmitPlugin/saveSubmit”] [unique_id “ZF1faXEvbgN7mXHTtCBHbwAAAMo”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/management/importexport/plugin/QuickSubmitPlugin
[Thu May 11 21:49:04.856774 2023] [:error] [pid 6189:tid 140707138361088] [client 169.150.218.88:44260] [client 169.150.218.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID-19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students’ chance to learn and develop their skill c…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/submission/saveStep/3”] [unique_id “ZF1i0HEvbgN7mXHTtCBHhwAAAMk”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/submission/wizard/1?submissionId=16
[Thu May 11 21:55:06.867556 2023] [:error] [pid 6189:tid 140707054434048] [client 169.150.218.88:44378] [client 169.150.218.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID-19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students’ chance to learn and develop their skill c…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/management/importexport/plugin/QuickSubmitPlugin/saveSubmit”] [unique_id “ZF1kOnEvbgN7mXHTtCBHqAAAANM”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/management/importexport/plugin/QuickSubmitPlugin/saveSubmit
[Thu May 11 21:57:52.787280 2023] [:error] [pid 6189:tid 140707037648640] [client 169.150.218.88:44466] [client 169.150.218.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID-19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students’ chance to learn and develop their skill c…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/16/publications/16”] [unique_id “ZF1k4HEvbgN7mXHTtCBHwQAAANU”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/16/1
[Thu May 11 21:59:20.002747 2023] [:error] [pid 6189:tid 140707062826752] [client 169.150.218.88:44468] [client 169.150.218.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID-19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students’ chance to learn and develop their skill c…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/16/publications/16”] [unique_id “ZF1lN3EvbgN7mXHTtCBHwgAAANI”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/16/1
[Thu May 11 22:00:14.042758 2023] [:error] [pid 6189:tid 140707029255936] [client 169.150.218.88:44470] [client 169.150.218.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students’ chance to learn and develop their skill co…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/16/publications/16”] [unique_id “ZF1lbnEvbgN7mXHTtCBHwwAAANY”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/16/1
[Thu May 11 22:00:16.920652 2023] [:error] [pid 6055:tid 140707155146496] [client 169.150.218.88:44472] [client 169.150.218.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students’ chance to learn and develop their skill co…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/16/publications/16”] [unique_id “ZF1lcMUr9-IlwIr3zH-mmwAAAIc”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/16/1
[Thu May 11 22:00:41.995461 2023] [:error] [pid 6189:tid 140707129968384] [client 169.150.218.88:44496] [client 169.150.218.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students’ chance to learn and develop their skill co…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/16/publications/16”] [unique_id “ZF1liXEvbgN7mXHTtCBHzAAAAMo”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/16/1
[Fri May 12 05:10:01.769511 2023] [:error] [pid 27266:tid 140300349572864] [client 138.199.21.207:47356] [client 138.199.21.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID-19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students’ chance to learn and develop their skill c…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/16/publications/16”] [unique_id “ZF3KKczEyz8oEpspgrsjqQAAAMg”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/16/1
[Fri May 12 05:11:40.901520 2023] [:error] [pid 27266:tid 140300282431232] [client 138.199.21.207:47358] [client 138.199.21.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID-19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students chance to learn and develop their skill co…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/16/publications/16”] [unique_id “ZF3KjMzEyz8oEpspgrsjqgAAANA”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/16/1
[Fri May 12 05:14:15.711346 2023] [:error] [pid 27266:tid 140300240467712] [client 138.199.21.207:47376] [client 138.199.21.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i)\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[=]|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)\\s*?[]|\\band\\b ?(?:\\d{1,10}|[\\'\”][^=]{1,10}[\\'\”]) ?[=]+|\\b(?i:and)\\b\\s+(\\d{1,10}|‘[^=]{1,10}’)" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “136”] [id “959072”] [rev “2”] [msg “SQL Injection Attack”] [data “Matched Data: and 3 found within ARGS:abstract[en_US]: Due to the COVID-19 pandemic, face-to-face instruction had to be suspended, and alternative education methods were chosen in order to stop the virus from spreading. Students were consequently compelled to digitally attend class and study from their homes. However, some higher education courses, such as Hospitality Management, which is a skill-based course, frequently call for laboratory work. The students chance to learn and develop their skill co…”] [severity “CRITICAL”] [ver “OWASP_CRS/2.2 [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/api/v1/submissions/16/publications/16”] [unique_id “ZF3LJ8zEyz8oEpspgrsjqwAAANU”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/workflow/index/16/1
[Fri May 12 05:26:06.664452 2023] [:error] [pid 27266:tid 140300341180160] [client 138.199.21.207:47658] [client 138.199.21.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i:(?:merge.?using\\s?\\()|(execute\\s*?immediate\\s*?[\”'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98])|(?:\\W+\\d*?\\s*?having\\s*?[^\\s\\-])|(?:match\\s*?[\\w(),±]+\\s*?against\\s*?\\())” at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “221”] [id “981256”] [msg “Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections”] [data “Matched Data: . Having d found within ARGS:abstract[en_US]: \x0d\x0aThis work sought to investigate the extent of sex education in safeguarding girl-child virginity in junior Secondary School in Obio Akpor Local Government Area of Rivers State. The researcher formulated three purposes of the study and three research questions that guided the study. Survey research design was used, the instrument used to obtain information was a structured questionnaire, the data collected were analyze…”] [severity “CRITICAL”] [tag [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/management/importexport/plugin/QuickSubmitPlugin/saveSubmit”] [unique_id “ZF3N7szEyz8oEpspgrsj5gAAAMk”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/management/importexport/plugin/QuickSubmitPlugin/saveSubmit
[Fri May 12 05:30:26.553308 2023] [:error] [pid 27266:tid 140300299216640] [client 138.199.21.207:47756] [client 138.199.21.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i:(?:merge.?using\\s?\\()|(execute\\s*?immediate\\s*?[\”‘`\xc2\xb4\xe2\x80\x99\xe2\x80\x98])|(?:\\W+\\d*?\\s*?having\\s*?[^\\s\\-])|(?:match\\s*?[\\w(),±]+\\s*?against\\s*?\\())" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “221”] [id “981256”] [msg “Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections”] [data “Matched Data: . Having d found within ARGS:abstract[en_US]: This work sought to investigate the extent of sex education in safeguarding girl-child virginity in junior Secondary School in Obio Akpor Local Government Area of Rivers State. The researcher formulated three purposes of the study and three research questions that guided the study. Survey research design was used, the instrument used to obtain information was a structured questionnaire, the data collected were analyzed using mean. The pop…”] [severity “CRITICAL”] [tag [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/submission/saveStep/3”] [unique_id “ZF3O8szEyz8oEpspgrsj_wAAAM4”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/submission/wizard/1?submissionId=18
[Fri May 12 05:34:07.194588 2023] [:error] [pid 27266:tid 140300349572864] [client 138.199.21.207:47786] [client 138.199.21.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?i:(?:merge.?using\\s?\\()|(execute\\s*?immediate\\s*?[\”’`\xc2\xb4\xe2\x80\x99\xe2\x80\x98])|(?:\\W+\\d*?\\s*?having\\s*?[^\\s\\-])|(?:match\\s*?[\\w(),±]+\\s*?against\\s*?\\())" at ARGS:abstract[en_US]. [file “/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf”] [line “221”] [id “981256”] [msg “Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections”] [data “Matched Data: . Having d found within ARGS:abstract[en_US]: This work sought to investigate the extent of sex education in safeguarding girl-child virginity in junior Secondary School in Obio Akpor Local Government Area of Rivers State. The researcher formulated three purposes of the study and three research questions that guided the study. Survey research design was used, the instrument used to obtain information was a structured questionnaire, the data collected were analyzed using mean. The pop…”] [severity “CRITICAL”] [tag [hostname “journals.frankridgeconsortium.com”] [uri “/index.php/GRNWO/submission/saveStep/3”] [unique_id “ZF3Pz8zEyz8oEpspgrskBgAAAMg”], referer: https://journals.frankridgeconsortium.com/index.php/GRNWO/submission/wizard/3?submissionId=18
I disabled the Mod Security for the subdomain and the files were uploaded without stress…
Now how to write the rules for the Mod Security to accommodate the special characters