3 ms·
An attacker can't necessarily leverage ASC/DESC injection unless multiple queries can be issued by a single SQL statement (i.e. injecting "ASC; SELECT * FROM...
by sillysaurus3 11y ago
An attacker can't necessarily leverage ASC/DESC injection unless multiple queries can be issued by a single SQL statement (i.e. injecting "ASC; SELECT * FROM...") which isn't commonly enabled in most database deployments. But there are probably other insecurities here.
The solution is to run every input through a function that replaces each single quote with two single quotes. That is all that's required to prevent SQL injection, since it's not possible to construct a valid query regardless of the injection point. (EDIT: This refers to string inputs. Numeric inputs are handled in the obvious way, as is ASC/DESC. Injection into an ORDER BY clause is not usually exploitable. These are all of the cases.)
If you propose this solution to management, they may be somewhat more likely to take action, since it can be applied to the existing system.
- steven777400 11y agoI respectfully disagree with your claim that replacing ' with '' will complete the security. Reason: there are non-string cases, so there exists concatenations like: "WHERE SomeNumber = " + inputValue + " ... " but inputValue is a string (from untyped xml), but is put into SQL without quotes because SomeNumber is an int type in the database. Since the xml is constructed without validation, an attacker could put any value there, including strings to inject, and do so without using quotes.
- sillysaurus3 11y agoYes, numeric cases are solved by running the input through a function that allows only numeric characters, [-.0-9]. That's the only other case. Management is more likely to listen to this, since it doesn't require a rewrite.
- continuational 11y agoHow can you be so sure that's the only other case?