WebApp Sec mailing list archives
Re: ISA Server and SQL Injection
From: Matthieu Estrade <mestrade () apache org>
Date: Fri, 18 Feb 2005 12:16:51 +0100
Sebastien Deleersnyder wrote:
you should read "howto do secure code for-----Original Message-----From: Matthieu Estrade [mailto:mestrade () apache org] Sent: donderdag 17 februari 2005 14:58To: webappsec () securityfocus com Subject: Re: ISA Server and SQL Injection Yes sure, if you code application using in parameter some SQL query,webapp".... Application mainly use value after used by the application inside aquery, but the query is in the code.http://www.toto.com/test.php?product_id=4 is ok and there is NO WAY tosee here some SQL Syntax.Be aware that the above parameter can directly be used to build up the SQL query such as SQLParam= "SELECT * FROM products WHERE productid = " & getParam("ProductId") This poses a danger when the 4 is replaced by "4 and 1=1" => gives back all the rows of the product table. You can imagine disaster scenario's with e.g. patient health data that is displayed. Also this will allow an attacker to provoke errors and from the errormessages deduct the table(s) structure, etc ... One of the best ways to prevent SQL injection is to build parameterized queries that will limit the variable data types used!
I agree, but if the web app fw see a "AND" + "1=1", he should block. AND is a part of SQL Syntax.
sorry yes, but i am not sure many developpers do this nowadays, so nobody will be fired. It was more to say that seeing an SQL query into a safe request is really rare so it can be protected by a webappfw blocking on SQL Syntax pattern matching.http://www.toto.com/test.php?product_id=SELECT%20*%20FROM%20product%20WHERE%20id=4 is not ok, and you shoud fire developper doing this.... Using parameters values doing directly actions is "HACKER FRIENDLY!"This is indeed not a good idea! But instead of firing, the developper should get educated.
--- infosecurity.be ---Bezoek ons tijdens Infosecurity.be 2005 op 23 of 24 maart in Brussels Kart Expo. Registreer vooraf en ontvang uw gratis toegangskaart via: http://www.databadge.net/isbe2005/reg/?link=4dd995bba9ac221908f3Voor meer info: http://www.ascure.com/default.asp?type=Eventsdetail&id={4D6980F0-651A-419A-93AF-E9EB42F74651}&lang={00000000-0000-0000-0001-000000000001}
Current thread:
- Re: ISA Server and SQL Injection, (continued)
- Re: ISA Server and SQL Injection Matthieu Estrade (Feb 17)
- RE: ISA Server and SQL Injection Marty Block (Feb 19)
- Re: ISA Server and SQL Injection fantomas (Feb 28)
- RE: ISA Server and SQL Injection Hofmeyr, Michael (ZA - Johannesburg) (Feb 15)
- Re: ISA Server and SQL Injection Darren Bounds (Feb 16)
- RE: ISA Server and SQL Injection charles freeman (Feb 16)
- RE: ISA Server and SQL Injection Roberto GABERGI (Feb 17)
- RE: ISA Server and SQL Injection Jeff Robertson (Feb 17)
- Re: ISA Server and SQL Injection Matthieu Estrade (Feb 17)
- RE: ISA Server and SQL Injection Sebastien Deleersnyder (Feb 19)
- Re: ISA Server and SQL Injection Matthieu Estrade (Feb 19)
- RE: ISA Server and SQL Injection Ofer Shezaf (Feb 21)
- RE: ISA Server and SQL Injection Mark Curphey (Feb 21)
- Solutions, Results, and Comments - Was [ISA Server and SQL Injection] Jeremiah Grossman (Feb 23)
- Re: Solutions, Results, and Comments - Was [ISA Server and SQL Injection] David (Feb 23)
- Re: Solutions, Results, and Comments - Was [ISA Server and SQL Injection] Jeremiah Grossman (Feb 28)
- storing SSNs, CCNs, password in the DB Francesco (Feb 28)
- Re: storing SSNs, CCNs, password in the DB Adam Shostack (Feb 28)
- Re: storing SSNs, CCNs, password in the DB Francesco (Feb 28)
- Re: storing SSNs, CCNs, password in the DB Andrew van der Stock (Mar 01)
- Re: storing SSNs, CCNs, password in the DB Paul Johnston (Mar 01)
- Re: ISA Server and SQL Injection Matthieu Estrade (Feb 19)