SQL Script Injection

Question

SQL Script Injection

Stacey

SSCommitted

Points: 1766
More actions
July 22, 2003 at 6:00 am

#83934

I was told about this error that may exsist on a server of mine. I serched the web and found that the issue exists against Sql Server 2000 which is not running SP3. However the server I was told about is a 7.0 box. First I am unable to recreate this error on the server second I am unable to see any documentation about it effecting 7.0 boxes. Is this an issue with 7.0 and if so what is the fix?!
Stacey W. A. Gregerson

Stacey W. A. Gregerson

Viewing 6 posts - 1 through 5 (of 5 total)

You must be logged in to reply to this topic. Login to reply

Frank Kalis SSC Guru Points: 111183 More actions · Answer 1

Hi Stacey,

quote:
I was told about this error that may exsist on a server of mine. I serched the web and found that the issue exists against Sql Server 2000 which is not running SP3. However the server I was told about is a 7.0 box. First I am unable to recreate this error on the server second I am unable to see any documentation about it effecting 7.0 boxes. Is this an issue with 7.0 and if so what is the fix?!

without further description on the error it will hard to find a solution.

However, both SQL2k and SQL7 are potentially exposed to SQL injection.

Maybe your issues is known on this sites

http://www.appsecinc.com

http://www.sqlsecurity.com (Here are also link to some other useful sites)

Any more details?

Cheers,

Frank

--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url]

K. Brian Kelley SSC Guru Points: 114642 More actions · Answer 2

To piggy-back on Frank...

SQL Injection is basically where an attacker can "slip in" another database command on top of a legitimate one. This is typically done against web sites. If a web application doesn't properly validate the input coming in, an attacker will be able to append a SQL query and the web application will pass it to the database server as a legitimate query. The weakness isn't at the database, it's at the application.

SQL Server, MySQL, and Oracle, among others are all potentially vulnerable to SQL Injection. It's not just limited to SQL Server.

In addition to the links Frank has posted, if you want to watch a webcast that takes you step-by-step through how a SQL Injection attack works, you might check out Brian Knight's webcast with Microsoft USA:

http://www.microsoft.com/usa/webcasts/ondemand/1765.asp

K. Brian Kelley

http://www.truthsolutions.com/

Author: Start to Finish Guide to SQL Server Performance Monitoring

http://www.netimpress.com/shop/product.asp?ProductID=NI-SQL1

K. Brian Kelley
@kbriankelley

Frank Kalis SSC Guru Points: 111183 More actions · Answer 3

Hi Brian,

quote:
To piggy-back on Frank...

sorry to ask, but what does this mean?

Cheers,

Frank

--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url]

K. Brian Kelley SSC Guru Points: 114642 More actions · Answer 4

It means to add-on to what you said.

It comes from a "piggy-back ride." When kids ride on an adult's back (child's legs around the adult's waist, child's hands/arms around the neck), we call that a piggy-back ride in the US.

K. Brian Kelley

http://www.truthsolutions.com/

Author: Start to Finish Guide to SQL Server Performance Monitoring

http://www.netimpress.com/shop/product.asp?ProductID=NI-SQL1

K. Brian Kelley
@kbriankelley

Frank Kalis SSC Guru Points: 111183 More actions · Answer 5

quote:
It comes from a "piggy-back ride." When kids ride on an adult's back (child's legs around the adult's waist, child's hands/arms around the neck), we call that a piggy-back ride in the US.

yes, I know this!

One of great thing that comes along as father's job

Thanks for explanation!

Cheers,

Frank

--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url]