Description

The SQL injection ' or 1==1;-- is not detected in Paranoia Level 1, while the expression with only one equals character (' or 1=1;--) is detected by rule 942100.

The option to use double "==" seems to be a specialty in sqlite (sqlite docs):

Since its rather a trivial variation of regular sql syntax, I think this should be covered in rule 942100 / PL 1.

How to reproduce

curl --location 'https://sandbox.coreruleset.org/' \
--header 'x-format-output: txt-matched-rules' \
--data-urlencode 'username="or 1==1;--'

Furthermore one OWASP Juiceshop challenge is SQL injection on the admin Login. With both expressions the exploit is possible.

Environment

• Coraza 3.3.3 or ModSecurity for Apache 2.9.8
• CRS 4.14.0