Skip to main content
A
Anonymous
August 6, 2008
Question

SQL Injection is rampant this week

  • August 6, 2008
  • 5 replies
  • 421 views
Setting of the stage:
I am using cf error reporting to send me an email whenever there is an exception error on my site.
I am using cfqueryparam to make sure SQL injection is not getting through

Trouble: using cfqueryparam to catch the attack causes an exception error whenever there is an attempted attack. So this morning I received 211 emails from the site (and they are still coming in) telling me "
Invalid data 4;DECLARE @S CHAR(4000);SET ...for CFSQLTYPE CF_SQL_INTEGER.

So is there a way to catch this error and simply abort and not send me the email? Maybe put a test in the error exception page that checks for ";declare, ;select ;delete; insert, etc..." Or maybe put a check in the application file to check the url variables for the same?

I am looking for ideas from others - I am SICK of my inbox getting jam packed with sql injection messages.

thnaks all!
Chris
    This topic has been closed for replies.

    5 replies

    S
    Stressed_Simon
    Inspiring
    August 6, 2008
    If you are using cferror then there is a struct called error, if you are using Application.cfc then in the onError() method there is a struct called arguments.exception.

    All unhandled error end up at one of these methods or templates (depending on approach), this struct contains all the details about the exception. You can check the type and all the other informatuion to see what type of error it is and handle them appropriately. If you don't want an email then don't send one. Certainly don't put try / catches around all the cfquery tags that is madness and wont solve it anyway. Only catch an error if there is something you can do about it.
    A
    Anonymous
    August 6, 2008
    Interestingly - this was the answer playing off your idea t - thanks....

    <set injectTerms = ";declare,;select,=cast(">
    <set inject =0>
    <loop list="#injectTerms#" index="i">
    <if refindnocase(#i#,#error.QueryString#)><set inject =1>MORON!<abort></if>
    </loop>
    tclaremont
    tclaremont
    Inspiring
    August 6, 2008
    In the very short term, you could use the logic of:

    <IF #errormessage# NEQ "Invalid data 4;DECLARE @S CHAR(4000);SET ...for CFSQLTYPE CF_SQL_INTEGER"> THEN send error message

    That should get you by until you wrap your head around a more elegant solution.
    A
    Anonymous
    August 6, 2008
    But wouldn't I have to wrap that around every one of my queries? That could take days. I want to do something from w/in the exception error template I would think.

    Is there a way to test for the cfqueryparam value issue only?
    N
    Newsgroup_User
    Inspiring
    August 6, 2008
    echowebs wrote:

    > I am looking for ideas from others - I am SICK of my inbox getting jam packed
    > with sql injection messages.
    >


    <cftry><cfcatch> is your friend here. Look up the documentation, you
    can get quite specific on what exceptions each <cfcatch...> block
    handles. So you could easily catch the injection attack exception and
    have it dumped to the void, but still have other exceptions send
    notifications to you.

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices