Solved

SQL Injection removal

Posted on 2008-10-07
3
324 Views
Last Modified: 2012-05-05
Dear Experts,

We are using IIS6 and SQL Server 2005 to host our clients websites.  One of our websites has been listed by Google with the warning 'This site may harm your computer.'

Having investigated this it would appear that the site is suffering from some kind of SQL Injection attack.  I have run the HP Scrawler tool which confirms that three pages are 'confirmed verbose'.  Having thereafter looked at these pages I cannot see anything strange in the code.  I have tried to find some information with regard to solving this problem but as yet have been unable to find a cure.

We also have SQL server 2008 installed on the server - would it help if I used SQL 2008 to host the database?

Any help would be hugely appreciated.

Regards

Grant
0
Comment
Question by:grantballantyne
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 9

Expert Comment

by:CCongdon
ID: 22662951
You might find that you have had the text fields in your database appended with the following text "<script src=....."
We had that happen. Here's part of what's wrong. Say you're running an e-commerce site, right? And when you go to a product page, you'll do something like a URL that says http://www.whatever.com/product.asp?ProdID=5
And that's fine...unless you allow dbo (Database owner) rights to your DB through the user name.
I had this happen to a client recently (I didn't make the site myself). Here's what I did to correct the problem:
1) I wrote an ASP script that sanatized my db
2) I made two SQL login accounts. One that had DBReader rights, and the other was DBWriter. The one with DBR is for showing stuff, and DBW is for putting stuff in.
3) Sanatize your Request variables before using them! For instance, if your product id is numeric field, the check to see if the Request.QueryString in the above example can be parsed as a number! If not, then drop it. Strip odd characters (such as quote, double quote, and semi-colons) from your data before mating it to a SQL statement. Better yet, use a parameterized query or stored procedure to recall your data from the DB.
0
 
LVL 6

Expert Comment

by:bcsql
ID: 22663411
CCongdon is exactly correct. The problem comes in when a user tries to add SQL commands to the fields in your pages like

;select * from syslogins;

if your fields are not checked and the user has permissions then the user could get all the information requested or execute commands as desired. This is a very simplified example.
0
 
LVL 9

Accepted Solution

by:
CCongdon earned 500 total points
ID: 22664086
@bcsql - even better, the script that hit my client had a bunch of gibberish enclosed in an EXEC statement. When revealed, the gibbersh was actually an entire SCRIPT!! This script ran through the system objects looking for accessible tables. It then scanned each of these tables for fields there were text types...and then appended rogue <script src="...."> tags onto each of these fields.... THE ENTIRE DATABASE!!!! EVERY TEXT FIELD!!!! I finally figured out how they were doing it by cranking the IIS logging up to max and keeping an eye on them. I finally noticed that most days the log files would be no more than 10MB or so...and then others where they'd be like 30-40MB. Going into those days revealed some pretty horrendous query strings on some of the catalog pages where there should have been nothing but a simple number. Took that and ran it carefully through SQL Studio and saw the ugly script. That's when I looked at the pages and realized that whoever had originally written it hadn't secured it very well.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
View SQL 2005 Job package 16 76
SQL Error - Query 6 49
JS does not refresh 6 38
Ajax on ASP 2 34
Introduction This article will provide a solution for an error that might occur installing a new SQL 2005 64-bit cluster. This article will assume that you are fully prepared to complete the installation and describes the error as it occurred durin…
So every once in a while at work I am asked to export data from one table and insert it into another on a different server.  I hate doing this.  There's so many different tables and data types.  Some column data needs quoted and some doesn't.  What …
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question