Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

SQL Injection removal

Posted on 2008-10-07
3
Medium Priority
?
329 Views
Last Modified: 2012-05-05
Dear Experts,

We are using IIS6 and SQL Server 2005 to host our clients websites.  One of our websites has been listed by Google with the warning 'This site may harm your computer.'

Having investigated this it would appear that the site is suffering from some kind of SQL Injection attack.  I have run the HP Scrawler tool which confirms that three pages are 'confirmed verbose'.  Having thereafter looked at these pages I cannot see anything strange in the code.  I have tried to find some information with regard to solving this problem but as yet have been unable to find a cure.

We also have SQL server 2008 installed on the server - would it help if I used SQL 2008 to host the database?

Any help would be hugely appreciated.

Regards

Grant
0
Comment
Question by:grantballantyne
  • 2
3 Comments
 
LVL 9

Expert Comment

by:CCongdon
ID: 22662951
You might find that you have had the text fields in your database appended with the following text "<script src=....."
We had that happen. Here's part of what's wrong. Say you're running an e-commerce site, right? And when you go to a product page, you'll do something like a URL that says http://www.whatever.com/product.asp?ProdID=5
And that's fine...unless you allow dbo (Database owner) rights to your DB through the user name.
I had this happen to a client recently (I didn't make the site myself). Here's what I did to correct the problem:
1) I wrote an ASP script that sanatized my db
2) I made two SQL login accounts. One that had DBReader rights, and the other was DBWriter. The one with DBR is for showing stuff, and DBW is for putting stuff in.
3) Sanatize your Request variables before using them! For instance, if your product id is numeric field, the check to see if the Request.QueryString in the above example can be parsed as a number! If not, then drop it. Strip odd characters (such as quote, double quote, and semi-colons) from your data before mating it to a SQL statement. Better yet, use a parameterized query or stored procedure to recall your data from the DB.
0
 
LVL 6

Expert Comment

by:bcsql
ID: 22663411
CCongdon is exactly correct. The problem comes in when a user tries to add SQL commands to the fields in your pages like

;select * from syslogins;

if your fields are not checked and the user has permissions then the user could get all the information requested or execute commands as desired. This is a very simplified example.
0
 
LVL 9

Accepted Solution

by:
CCongdon earned 2000 total points
ID: 22664086
@bcsql - even better, the script that hit my client had a bunch of gibberish enclosed in an EXEC statement. When revealed, the gibbersh was actually an entire SCRIPT!! This script ran through the system objects looking for accessible tables. It then scanned each of these tables for fields there were text types...and then appended rogue <script src="...."> tags onto each of these fields.... THE ENTIRE DATABASE!!!! EVERY TEXT FIELD!!!! I finally figured out how they were doing it by cranking the IIS logging up to max and keeping an eye on them. I finally noticed that most days the log files would be no more than 10MB or so...and then others where they'd be like 30-40MB. Going into those days revealed some pretty horrendous query strings on some of the catalog pages where there should have been nothing but a simple number. Took that and ran it carefully through SQL Studio and saw the ugly script. That's when I looked at the pages and realized that whoever had originally written it hadn't secured it very well.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello, all! I just recently started using Microsoft's IIS 7.5 within Windows 7, as I just downloaded and installed the 90 day trial of Windows 7. (Got to love Microsoft for allowing 90 days) The main reason for downloading and testing Windows 7 is t…
INTRODUCTION: While tying your database objects into builds and your enterprise source control system takes a third-party product (like Visual Studio Database Edition or Red-Gate's SQL Source Control), you can achieve some protection using a sing…
Are you ready to place your question in front of subject-matter experts for more timely responses? With the release of Priority Question, Premium Members, Team Accounts and Qualified Experts can now identify the emergent level of their issue, signal…
Screencast - Getting to Know the Pipeline

926 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question