Re: Help We Got Hacked with a SQL Injector

razor (razor@xxxxxxxxxxxxxxxxxxxxxxxxx) writes:
Over the weekend our IIS server that we host our website on started
serving up Trojans to everyone that visited our website. We traced it
back to the below (see link).
http://s3cwatch.wordpress.com/2008/06/22/wwwj8j8heicnkjs/

We have a solid firewall and don't have any services enabled that we
don't need, and just wondered if anyone knows some way we can prevent
this in the future? I will pass along any info to our SQL DB manager.

Review how you access SQL Server from your web site. Make sure that
you never get input parameters directly into SQL string, but always
use parameterised commands. For a quick introduction on SQL injection,
see here: http://www.sommarskog.se/dynamic_sql.html#SQL_injection


--
Erland Sommarskog, SQL Server MVP, esquel@xxxxxxxxxxxxx

Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx
.

Relevant Pages

  • Re: Query training -- Complex queries
    ... > Update PositionsEOM ... Here you don't have a derived table, but a correlated subquery. ... UPDATE in Books Online. ... is not written for SQL Server. ...
    (microsoft.public.sqlserver.server)
  • Re: Linked Server: How to check if server exists?
    ... The root problem is described in the Books Online topic Batches. ... Rick Byham, SQL Server Books Online ... linked server don't run on those development machines not having that linked ...
    (microsoft.public.sqlserver.connect)
  • Re: STORED PROCEDURE - passing table name as a parameter
    ... T-SQL, is that you get problems if the view definition does not fit into ... will need to query other system tables, for instance syscolumns. ... Erland Sommarskog, SQL Server MVP, esquel@xxxxxxxxxxxxx ... Books Online for SQL Server 2005 at ...
    (comp.databases.ms-sqlserver)
  • Re: Problem when changing Views
    ... There aree several reasons. ... I use neither of the tools, but I guess that Design View resubmits the ... Erland Sommarskog, SQL Server MVP, esquel@xxxxxxxxxxxxx ... Books Online for SQL Server 2005 at ...
    (comp.databases.ms-sqlserver)
  • Re: SQL 2005: Help files not valid?
    ... Please try the following instructions to remove and reinstall Books Online. ... If this doesn't solve the problem, we'll need to get the Visual Studio folks ... In Add or Remove Programs, select Microsoft SQL Server 2005, and then ... Complete the remaining steps in the Installation Wizard. ...
    (microsoft.public.sqlserver.setup)