RE: about SQL injection

["choongseng" <choongseng () lovelyhome org>]

That is a very common vulnerability.

YES, it is a big vulnerability!!
That means a hacker and retrieve almost everything that the account that you
used to establish the connection to the SQL server.

And further more, if the account is a powerful one which can create another
account, or have administrative rights, which can run shell command, you are
dead.

You have to ensure you validate all the user inputs, either you HTML encode
it, or you should use SQLParameter if you are using ADO.NET. And the account
that you establish the connection with your SQL, should have only minimal
rights.

Regards,
choongseng

-----Original Message-----
From: Seung Hyun Cho [mailto:s970501 () gmail com] 
Sent: Sunday, April 03, 2005 9:08 PM
To: security-basics () securityfocus com
Subject: about SQL injection

Hi,

I am running my site on IIS & MS-SQL.

I've found vulnerabilities in some pages.
exploited query is working like...
"select * from xxx where id=3"
when I put something like '2 or 1=1', it shows every data in xxx.

But... is it kind of big vulnerability?
What hacker can do to my site in this situation?

Thanks,

---------------------------------------------------------------------------
Earn your MS in Information Security ONLINE
Organizations worldwide are in need of highly qualified information security

professionals.  Norwich University is fulfilling this demand with its MS in 
Information Security offered online.  Recognized by the NSA as an 
academically excellent program, NU offers you the opportunity to earn your 
degree without disrupting your home or work life.

http://www.msia.norwich.edu/secfocus_en
----------------------------------------------------------------------------




---------------------------------------------------------------------------
Earn your MS in Information Security ONLINE
Organizations worldwide are in need of highly qualified information security 
professionals.  Norwich University is fulfilling this demand with its MS in 
Information Security offered online.  Recognized by the NSA as an 
academically excellent program, NU offers you the opportunity to earn your 
degree without disrupting your home or work life.

http://www.msia.norwich.edu/secfocus_en
----------------------------------------------------------------------------