Sebastien Deleersnyder wrote:
-----Original Message-----
From: Matthieu Estrade [mailto:mestrade@apache.org]
Sent: donderdag 17 februari 2005 14:58
To: webappsec@securityfocus.com
Subject: Re: ISA Server and SQL Injection
Yes sure, if you code application using in parameter some SQL query,
you should read "howto do secure code for
webapp"....
Application mainly use value after used by the application inside a
query, but the query is in the code.
http://www.toto.com/test.php?product_id=4 is ok and there is NO WAY to
see here some SQL Syntax.
Be aware that the above parameter can directly be used to build up the
SQL query such as
SQLParam= "SELECT * FROM products WHERE productid = " &
getParam("ProductId")
This poses a danger when the 4 is replaced by "4 and 1=1" => gives back
all the rows of the product table.
You can imagine disaster scenario's with e.g. patient health data that
is displayed.
Also this will allow an attacker to provoke errors and from the
errormessages deduct the table(s) structure, etc ...
One of the best ways to prevent SQL injection is to build parameterized
queries that will limit the variable data types used!
I agree, but if the web app fw see a "AND" + "1=1", he should block.
AND is a part of SQL Syntax.
http://www.toto.com/test.php?product_id=SELECT%20*%20FROM%20product%20W
HERE
%20id=4 is not ok, and you shoud fire developper doing this....
Using parameters values doing directly actions is "HACKER FRIENDLY!"
This is indeed not a good idea! But instead of firing, the developper
should get educated.
sorry yes, but i am not sure many developpers do this nowadays, so
nobody will be fired.
It was more to say that seeing an SQL query into a safe request is
really rare so it can be protected by a webappfw blocking on SQL Syntax
pattern matching.
--- infosecurity.be ---
Bezoek ons tijdens Infosecurity.be 2005 op 23 of 24 maart in Brussels Kart Expo.
Registreer vooraf en ontvang uw gratis toegangskaart via:
http://www.databadge.net/isbe2005/reg/?link=4dd995bba9ac221908f3
Voor meer info:
http://www.ascure.com/default.asp?type=Eventsdetail&id={4D6980F0-651A-419A-93AF-E9EB42F74651}&lang={00000000-0000-0000-0001-000000000001}
