[mod-security-users] [CRS rules] CRS rules not saving from SQL-Injections

[Cr3a70r <sic...@gm...>]

Hello.
I have inabled CRS sql-injection rules upon my VPS server.
Made a test database with login-password and set up a php post-form without
any filter on user-input.
After this I tried sqlmap on this php post-form and successfully exploited
SQL-Injection.
How is that possible?