Improving Web Application Security: Threats and - CGISecurity

Chapter 14: Building Secure Data Access 369Figure 14.1 illustrates these top threats.UnauthorizedAccessSQL InjectionDisclosure ofSchema andConnectionDetailsNetworkEavesdroppingClientWeb AppSQLServerDisclosure ofConfigurationDataFirewallConfiguration Data(ConnectionStrings)Disclosure ofSensitiveApplicationDataFigure 14.1Threats and attacks to data access codeSQL InjectionSQL injection attacks exploit vulnerable data access code and allow an attacker toexecute arbitrary commands in the database. The threat is greater if the applicationuses an unconstrained account in the database because this gives the attacker greaterfreedom to execute queries and commands.VulnerabilitiesCommon vulnerabilities that make your data access code susceptible to SQL injectionattacks include:● Weak input validation● Dynamic construction of SQL statements without the use of type-safe parameters●Use of over-privileged database logins