I have a classic example of attempts at SQL Injection on my site. So far, they haven't been able to get through. I thought I had locked down the code, but I'm still gettting hundreds of the following error notifications:
Error Message: Error Executing Database Query.
ERROR.QueryString: PageNum_getProduct=2&Key=g
auge&Manuf
acturer=&C
olor=&Text
ureType=&B
ooksOnly=&
CatID=&Sub
CatID=&Sor
t=;DECLARE
%20@S%20CH
AR(4000);S
ET%20@S=CA
ST(0x44454
34C4152452
0405420766
172 [Edited by Lunchy]
Error on Page: /Results.cfm
Previous Page:
--------------------------
----------
Error Executing Database Query. Syntax error or access violation: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near ';DECLARE @S CHAR(4000);SET @S=CAST(0x4445434C41524520
4054207661
The error occurred on line 123.
So, I am checking the submitted parameters as follows:
<cfif IsDefined('CatID') AND CatID NEQ "" AND NOT IsNumeric(CatID)>
<cflocation url="index.cfm">
<cfelseif IsDefined('SubCatID') AND SubCatID NEQ "" AND NOT IsNumeric(SubCatID)>
<cflocation url="index.cfm">
<cfelseif IsDefined('Sort') AND Sort NEQ "" AND Len(Sort) GT 20>
<cflocation url="index.cfm">
</cfif>
When I test this on my dev box, it catches the error and routes back to the index.cfm page, as expected. So how come they are still getting past this code and far enough to be submitted to the database?
Start Free Trial
