SQL - Warning Injection via querystring

[RFH Reseller: SKILLIT]

From this mornings web server logs it appears some nice person from China, has been attempting to use a query string (subsequently used in a select) to attempt multiple selects from other databases.

It is indeed good fortune that I don't have admin authority over any other databases other than mine.

I have now modified the code to only use the first two characters of the string if they are numeric and in other cases to return a 404 and then end the response.

For those that may be interested I attach a log extract.

David.

[Staff: Warren Ashcroft]

Unfortunately many people don't realise how important it is to validate any "variables" you use in SQL queries.

[RFH Reseller: askjim]

A few items may be of interest:

asp.net is great at assisting to reduce sql and html injection hacks as long as you do not turn of request validation.

Ensure you use parameters with database calls and ideally stored procedures.

We have started testing sites with PCI compliance testing tools which have revealed vunerabilities on some of our customer sites. We soon stopped testing though because of the volume of traffic the testing caused which nearly caused interuption to services.

A week later we then find out why one of our servers had a glitch, a customer had been scanning their site as they had been blagged that they needed to when infact they did not need to as they used world pay. What a salesman the person must have been.