Question

This one threw me for a loop – not even sure where to start looking.

If you submit a form in my CakePHP application with the words “select” and “from” in any text area, it errors out:

Missing Controller

Error: 500.shtmlController could not be found.

Error: Create the class 500.shtmlController below in file: app/controllers/500.shtml_controller.php

<?php
    class 500.shtmlController extends AppController {
        var $name = '500.shtml';
    }
?>

Notice: If you want to customize this error message, create app/views/errors/missing_controller.ctp

Even if you type “selected blah fromy”, it will error. BUT – if you type them in reverse order, it’s not a problem – you CAN type “from select blah blah …etc” and it’s no issue.

I’m using the jquery validator plugin (but I have to assume it’s not on the javascript side – seems like it must be something w/ Cake / MySQL?)

ANY thoughts very welcome.

Answer 1

Do you have ModSecurity installed on Apache? It looks like your string triggers its pattern:

(insert[[:space:]]+into.+values|select.*from.+[a-z|A-Z|0-9]|select.+from|bulk[[:space:]]+insert|union.+select|convert.+\\(.*from)

Look for something like ModSecurity: Access denied with code 500 (phase 2) in your error log.

And it looks like you’ve disabled default Pages route:

Router::connect('/pages/*', array('controller' => 'pages', 'action' => 'display'));

so Cake tries to route request for domain.com/500.shtml to 500.shtmlController.