Solved

SQL injuection query

Posted on 2006-06-21
4
596 Views
Last Modified: 2012-06-21
Hi,

I've trapped some SQL injection attempts on my web server.

I'm just wondering if anyone can tell me what this query would have done if it had succeeded?

id=90 And char(124)+Cast(IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00) as varchar(1))+char(124)=1

This was passed as a parameter on a page that would normally accept: category.asp?id=90
I'm particularly interested in what IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00) is..

Thanks!!
0
Comment
Question by:azaram
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 75

Assisted Solution

by:Aneesh Retnakaran
Aneesh Retnakaran earned 200 total points
ID: 16957260
Run this

select * from master..sysxlogins
WHERE sid = '0x730079007300610064006D0069006E00'

0
 
LVL 75

Assisted Solution

by:Aneesh Retnakaran
Aneesh Retnakaran earned 200 total points
ID: 16957264

from BOL
IS_SRVROLEMEMBER Indicates whether the current user login is a member of the specified server role

IS_SRVROLEMEMBER ( 'role' [ , 'login' ] )
0
 
LVL 16

Accepted Solution

by:
Swapnil Piparia earned 300 total points
ID: 16957288
Hi azaram,
IS_SRVROLEMEMBER function

Indicates whether the current user login is a member of the specified server role. it will check from following role and the hex code given your url string is for one of the following role.
sysadmin
dbcreator
diskadmin
processadmin
serveradmin
setupadmin
securityadmin

the try is make to check that the current sql login for fetching data for id 90 has access of which role if it

like s
select * from table where id =90 and char(124)+Cast(IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00) as varchar(1))+char(124)=1

means if login has this role right than it will return record otherwise not


Regards,
NetSwap
0
 

Author Comment

by:azaram
ID: 16957326
Thanks... so it looks like it's just fishing for holes..
I guess if the SQL injection was successful and also if the server role had admin access they may launch another attack to execute system commands and compromise the server.
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Why is this different from all of the other step by step guides?  Because I make a living as a DBA and not as a writer and I lived through this experience. Defining the name: When I talk to people they say different names on this subject stuff l…
I have a large data set and a SSIS package. How can I load this file in multi threading?
Using examples as well as descriptions, and references to Books Online, show the different Recovery Models available in SQL Server and explain, as well as show how full, differential and transaction log backups are performed
Viewers will learn how to use the SELECT statement in SQL to return specific rows and columns, with various degrees of sorting and limits in place.

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question