SQL Injection Attacks and Defense - 2009

328 Chapter 7 • Advanced Topics
Requesting this URL causes the application to make a number of SQL queries
of the form:
UPDATE profile SET lang='en' WHERE UID=2104
UPDATE profile SET region='uk' WHERE UID=2104
UPDATE profile SET currency='gbp' WHERE UID=2104
...
Because the fields used for preferences change over time, the developers decided to take
a shortcut and implemented the functionality as follows:
IEnumerator i = Request.QueryString.GetEnumerator();
while (i.MoveNext())
{
}
string name = (string)i.Current;
string query = "UPDATE profile SET " + name + "='"
+ Request.QueryString[name].Replace("'", "''") +
"' WHERE uid=" + uid;
...
This code enumerates all of the parameters supplied in the querystring, and builds an
SQL query using each one. Although quotation marks in parameter values are being escaped,
in an attempt to block SQL injection attacks, the parameter values are embedded directly
into the query without any filtering. Hence, the application is vulnerable, but only if you
place your attack into a parameter name.
A similar vulnerability can arise if the application contains a custom logging mechanism
which saves to the database all requested URLs, including the querystring. If the input filters
validate parameter values but not parameter names, you can place payloads into a parameter
name to exploit the vulnerability.
Another entry point which applicationwide input filters typically overlook is the
headers within HTTP requests. Application code can process HTTP headers in arbitrary
ways, and applications frequently process headers such as Host, Referer, and User-Agent in
application-level logging mechanisms. If the values of request headers are incorporated
into SQL queries in an unsafe manner, you may be able to perform SQL injection by
attacking these entry points.