In the course of the last penetration testing, I had an occasion to work with the following web application architecture:
I guess you will ask me, what’s wrong here?
The problem is that Oracle is not MySQL, and it simply doesn’t "know" about any shielding in the form of backlashes :) Oracle doesn’t consider the concept of shielding at all, because it’s a serious DBMS:
It should be mentioned that we have met a lot of Oracle DBMSs during the last penetration testing, and most of them contained the described vulnerability, i.e. they had a universal login "'or(1)=(1)--" (aka SQL Injection).
A similar feature of interpretation of a backslash ("\") as an independent symbol is characteristic for Microsoft SQL Server, too:
For the Sybase database, we have:
Thus, it is necessary to take such features of DBMSs into account in the course of programming and porting your applications to various databases to avoid problems relating to SQL Injection.
Comment: this topic was described by Bernardo Damele [1,2] in his blog one year ago, but the practice shows that the problem is still urgent.
This comment has been removed by a blog administrator.
ReplyDeleteThis comment has been removed by a blog administrator.
ReplyDelete