# Security Scan Spring4Shell

**URL:** <https://forum.infinityfree.com/t/security-scan-spring4shell/81281>\
**Category:** Hosting Support\
**Created:** [August 19, 2023, 9:00pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281 "2023-08-19T21:00:25Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![FatDude](https://forum.infinityfree.com/letter_avatar/fatdude/32/6_22734026db12803ebb3e059622ac3534.png) [@FatDude](https://forum.infinityfree.com/u/FatDude)\
**Post date:** [August 19, 2023, 9:00pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/1 "2023-08-19T21:00:25Z")

</div>

### Website URL

www.eloi.biz

### Error Message

Spring4Shell Vulnerability

### Other Information

(other information and details relevant to your question)

---

<div class="post-metadata">

**Author:** ![Greenreader9](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/greenreader9/32/22847_2.png) [@Greenreader9](https://forum.infinityfree.com/u/Greenreader9)\
**Post date:** [August 19, 2023, 9:41pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/2 "2023-08-19T21:41:12Z")

</div>

Can you please provide some additional information about your request?

---

<div class="post-metadata">

**Author:** ![ChrisPAR](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/chrispar/32/8743_2.png) [@ChrisPAR](https://forum.infinityfree.com/u/ChrisPAR)\
**Post date:** [August 19, 2023, 9:42pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/3 "2023-08-19T21:42:22Z")

</div>

Having a look, this vulnerability you’re mentioning seems to be related to Spring, a framework for Java:

> **[CVE-2022-22965 Analyzing the Exploitation of Spring4Shell Vulnerability in...](https://www.trendmicro.com/en_be/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html)**

Java is not supported on our hosting anyway, so what is the issue you’re facing?

---

<div class="post-metadata">

**Author:** ![FatDude](https://forum.infinityfree.com/letter_avatar/fatdude/32/6_22734026db12803ebb3e059622ac3534.png) [@FatDude](https://forum.infinityfree.com/u/FatDude)\
**Post date:** [August 19, 2023, 11:15pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/4 "2023-08-19T23:15:17Z")

</div>

I cant seem to get prepared statement to write to the data base.

---

<div class="post-metadata">

**Author:** ![ChrisPAR](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/chrispar/32/8743_2.png) [@ChrisPAR](https://forum.infinityfree.com/u/ChrisPAR)\
**Post date:** [August 19, 2023, 11:41pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/5 "2023-08-19T23:41:08Z")

</div>

What statement? From where? Please be more specific.

Since you linked to a Java issue, I can take a wild guess and assume you’re trying to do it via Java. Unfortunately, you’re likely hitting one or more of these limitations:

> [@Connecting to MySQL from an external application](https://forum.infinityfree.com/t/connecting-to-mysql-from-an-external-application/49339):
>
> Sometimes, you may want to connect to your MySQL database on your free hosting account using external software, like a desktop database manager (like MySQL Workbench) or an external program you wrote yourself (like an Android or iOS app). You cannot connect to a free hosting MySQL database from outside your hosting account. You can only interact with your free hosting database through PHP scripts uploaded to your free hosting account, or through our phpMyAdmin installation. The ability to con…

> [@Ensuring only web browsers can access your website](https://forum.infinityfree.com/t/ensuring-only-web-browsers-can-access-your-website/49353):
>
> InfinityFree is a website hosting service. That means that the hosting accounts we provided are intended for hosting websites. Websites contain pages that are accessed through web browsers. InfinityFree is not intended to be used for file sharing, API hosting, database hosting or background tasks/tools. To help enforce this, free hosting enforces a security system that makes sure that anyone trying to access your website is using a normal web browser. This is done by checking whether the web br…

You’ll need to use that prepared statement in a PHP script inside your free hosting account. If that’s what you’re doing but it isn’t working, please provide more information.

---

<div class="post-metadata">

**Author:** ![FatDude](https://forum.infinityfree.com/letter_avatar/fatdude/32/6_22734026db12803ebb3e059622ac3534.png) [@FatDude](https://forum.infinityfree.com/u/FatDude)\
**Post date:** [August 20, 2023, 12:22am UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/6 "2023-08-20T00:22:08Z")

</div>

I am using PHP uploaded to InfinityFree to prepare two statements wich are executed without error but the data does not show up in the mySQL database.

---

<div class="post-metadata">

**Author:** ![Meishin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/meishin/32/59902_2.png) [@Meishin](https://forum.infinityfree.com/u/Meishin)\
**Post date:** [August 20, 2023, 12:27am UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/7 "2023-08-20T00:27:12Z")

</div>

What is your prepared statement? That’s also what we are asking for.

---

<div class="post-metadata">

**Author:** ![FatDude](https://forum.infinityfree.com/letter_avatar/fatdude/32/6_22734026db12803ebb3e059622ac3534.png) [@FatDude](https://forum.infinityfree.com/u/FatDude)\
**Post date:** [August 20, 2023, 2:19pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/8 "2023-08-20T14:19:37Z")

</div>

Here you go:

```auto
// prepare and bind
$stmt1 = $conn->prepare("INSERT INTO whales( `id`, `message`,`ip`, `agent`, `SERVER_NAME`, `REQUEST_METHOD`,
       `HTTP_ACCEPT_LANGUAGE`, `HTTP_REFERER`, `REQUEST_URI`, `PATH_INFO`, 
      `HTTPS`, `REMOTE_PORT`, `REMOTE_USER`, `SCRIPT_FILENAME` ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?,?, ?, ?,?, ?)");
$stmt1->bind_param("ssssssssssssss", $id, $Summary, $REMOTE_ADDR,$HTTP_USER_AGENT,$SERVER_NAME,
	$REQUEST_METHOD,$HTTP_ACCEPT_LANGUAGE, $HTTP_REFERER,$REQUEST_URI, 
	$PATH_INFO,$HTTPS,$REMOTE_PORT,$REMOTE_USER, $SCRIPT_FILENAME);

// prepare and bind
$stmt2 = $conn->prepare("INSERT INTO whales ( `attachment`,`id`, `message`,`ip`, `agent`, `SERVER_NAME`, `REQUEST_METHOD`,
       `HTTP_ACCEPT_LANGUAGE`, `HTTP_REFERER`, `REQUEST_URI`, `PATH_INFO`, 
      `HTTPS`, `REMOTE_PORT`, `REMOTE_USER`, `SCRIPT_FILENAME` ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?,?, ?, ?,?, ?, ?)");
$stmt2->bind_param( "sssssssssssssss", $imgnewfile, $id, $Summary, $REMOTE_ADDR,$HTTP_USER_AGENT,$SERVER_NAME,
	$REQUEST_METHOD,$HTTP_ACCEPT_LANGUAGE, $HTTP_REFERER,$REQUEST_URI, 
	$PATH_INFO,$HTTPS,$REMOTE_PORT,$REMOTE_USER, $SCRIPT_FILENAME);

```

---

<div class="post-metadata">

**Author:** ![anon42008019](https://forum.infinityfree.com/letter_avatar/anon42008019/32/6_22734026db12803ebb3e059622ac3534.png) [@anon42008019](https://forum.infinityfree.com/u/anon42008019)\
**Post date:** [August 20, 2023, 3:39pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/9 "2023-08-20T15:39:24Z")

</div>

Don’t you execute the statements?

---

<div class="post-metadata">

**Author:** ![FatDude](https://forum.infinityfree.com/letter_avatar/fatdude/32/6_22734026db12803ebb3e059622ac3534.png) [@FatDude](https://forum.infinityfree.com/u/FatDude)\
**Post date:** [August 20, 2023, 5:08pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/10 "2023-08-20T17:08:07Z")

</div>

Yes I execute the statements. Are you able to use prepared statements on this site?

---

<div class="post-metadata">

**Author:** ![anon42008019](https://forum.infinityfree.com/letter_avatar/anon42008019/32/6_22734026db12803ebb3e059622ac3534.png) [@anon42008019](https://forum.infinityfree.com/u/anon42008019)\
**Post date:** [August 20, 2023, 5:39pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/11 "2023-08-20T17:39:29Z")

</div>

Yes, you need to fetch the error messages like this:

```auto
if (!$stmt1->execute()){
    echo "Stmt1 error:".$stmt1->error;
}
if (!$stmt2->execute()){
    echo "Stmt2 error:".$stmt2->error;
}

```

---

<div class="post-metadata">

**Author:** ![FatDude](https://forum.infinityfree.com/letter_avatar/fatdude/32/6_22734026db12803ebb3e059622ac3534.png) [@FatDude](https://forum.infinityfree.com/u/FatDude)\
**Post date:** [August 21, 2023, 10:10pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/12 "2023-08-21T22:10:40Z")

</div>

OK thanks!

---

<div class="post-metadata">

**Author:** ![system](https://infinityfree-forum-uploads.s3.dualstack.eu-central-1.amazonaws.com/original/3X/b/0/b024fd3fa88bae093c9576e55c2c94e33f890206.svg) [@system](https://forum.infinityfree.com/u/system)\
**Post date:** [August 28, 2023, 10:11pm UTC](https://forum.infinityfree.com/t/security-scan-spring4shell/81281/13 "2023-08-28T22:11:33Z")

</div>

Closed on August 28, 2023, 10:11pm UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.