Home | Projects | Downloads | Contact Me | SQL Injection Attacks

A Stop Gap Measure for Current SQL Injection

Posted At : July 23, 2008 6:09 PM | Posted By : Shane Zehnder
Related Categories: Coldfusion,Development

Okay, we all know the best way to secure a query is the use of a CFQueryParam statement.  I sent off a quick IM to a friend of mine today telling him I had a few attacks on my site and it would behoove him to make sure he battens down all the hatches.  I know he has quite a few sites and as he was in a panic attack I looked around to help him find a quick solution.

After reading Mark Kruger's article SQL Injection Part II (Make Sure You Are Sitting Down) I came up with something quick that is inelegant, but it works for this attack method.

Just add the following code to the top of your application.cfm file (or the appropriate section in application.cfc).

<cfif len(CGI.QUERY_STRING) AND findNoCase("declare",CGI.QUERY_STRING)>
-Insert some cheeky comments here-
<cfabort />
</cfif>

I DO NOT suggest using this for very long, but it could buy you some time if you need to update some queries.



Comments (4) | Print | Send | del.icio.us | Digg It! | Linking Blogs | 680 Views
Comments
[Add Comment]
todd sharp's Gravatar What about form fields? The malicious code can also be passed through them just as easily. And I'd hate to abort out a request because someone typed 'declare' in a textarea.
# Posted By todd sharp | 7/23/08 6:49 PM
Shane Zehnder's Gravatar Aye. Well it does not take the form scope into account so it COULD be bad news it you are sending forms using GET instead of POST.

The best way to avoid the situation altogether is using cfqueryparam. As I said it is a VERY inelegant solution but it does beat the alternative.

Thanks for pointing that out though Todd. Sharp as always.

A little play on words there. ;)
# Posted By Shane Zehnder | 7/23/08 7:13 PM
todd sharp's Gravatar Well what I meant was, since it doesn't take the form scope into account you'd miss an injection passed via a form POST. But as you said, it's a stop gap and if it were my sites I'd be all over fixing the queries ASAP.

And thanks for the compliment :)
# Posted By todd sharp | 7/23/08 7:26 PM
Shane Zehnder's Gravatar Russ Michaels just did a post with a much more secure version, IMO.

http://russ.michaels.me.uk/index.cfm/2008/7/24/SQL...

This protects the url and form scope, plus they can still have DECLARE in a textarea. :)
# Posted By Shane Zehnder | 7/24/08 12:32 PM
[Add Comment]
Layout: Shane Zehnder ::: BlogCFC was created by Raymond Camden. ::: This blog is running version 5.9.