Re: about SQL injection

From: David MacDonald (davidpmacdonald_at_gmail.com)
Date: 04/05/05

  • Next message: Fields, James: "RE: an error in the NMAP docs?" 
    Date: Tue, 5 Apr 2005 08:52:25 -0300
To: Seung Hyun Cho <s970501@gmail.com>

    The vulnerability lies in your html/asp/jsp/cgi page and not the
    database. Filter out single quotes, double quotes, keywords like or
    and select from your query before it hits your database. A person who
    can perform the injection can potentially retrieve a lot of
    information, that is if the usernames and passwords in your database
    are used elsewhere in your network/system. Do a google search on
    filtering sql injection.

    Dave

    On Apr 3, 2005 10:07 AM, Seung Hyun Cho <s970501@gmail.com> wrote:
    > Hi,
    >
    > I am running my site on IIS & MS-SQL.
    >
    > I've found vulnerabilities in some pages.
    > exploited query is working like...
    > "select * from xxx where id=3"
    > when I put something like '2 or 1=1', it shows every data in xxx.
    >
    > But... is it kind of big vulnerability?
    > What hacker can do to my site in this situation?
    >
    > Thanks,
    >
    > ---------------------------------------------------------------------------
    > Earn your MS in Information Security ONLINE
    > Organizations worldwide are in need of highly qualified information security
    > professionals. Norwich University is fulfilling this demand with its MS in
    > Information Security offered online. Recognized by the NSA as an
    > academically excellent program, NU offers you the opportunity to earn your
    > degree without disrupting your home or work life.
    >
    > http://www.msia.norwich.edu/secfocus_en
    > ----------------------------------------------------------------------------
    >
    >

    ---------------------------------------------------------------------------
    Earn your MS in Information Security ONLINE
    Organizations worldwide are in need of highly qualified information security
    professionals. Norwich University is fulfilling this demand with its MS in
    Information Security offered online. Recognized by the NSA as an
    academically excellent program, NU offers you the opportunity to earn your
    degree without disrupting your home or work life.

    http://www.msia.norwich.edu/secfocus_en
    ----------------------------------------------------------------------------

  • Next message: Fields, James: "RE: an error in the NMAP docs?"

    Relevant Pages

    • RE: about SQL injection
      ... That is a very common vulnerability. ... That means a hacker and retrieve almost everything that the account that you ... Earn your MS in Information Security ONLINE ...
      (Security-Basics)
    • Re: about SQL injection
      ... 2; drop database ... which has obvious downsides. ... Earn your MS in Information Security ONLINE ...
      (Security-Basics)
    • Re: Microsoft Software Auditing ?
      ... |>Earn your MS in Information Security ONLINE ... Recognized by the NSA as an ... |>your degree without disrupting your home or work life. ...
      (Security-Basics)
    • RE: Hacked (...still cleaning)
      ... folder no included on the system path with a different name. ... files, he used that for installing it as a service probably, open it ... Earn your MS in Information Security ONLINE Organizations worldwide ...
      (Security-Basics)
    • RE: Hacked (...still cleaning)
      ... If you want good protection you really need to wipe ... If you want to recover from this it can be expensive and iffy at ... > Earn your MS in Information Security ONLINE Organizations worldwide are ... > in need of highly qualified information security professionals. ...
      (Security-Basics)