Highlighted

SQL injection

Participant ,
Jan 19, 2015

Copy link to clipboard

Copied

I have a very large website that is constantly under attack via SQL injection.

My SQL DB is corrupted weekly.

I am in the process of doing the <cfqueryparam value throughout the site.

But in the short term is there something I can add to the application.cfm if I know part of the string that is always been injected?

For example if I know that the string "www.paydayloans.com" is trying to be maliciously passed is there some code I can add to prevent that from being used in the query?

Views

197

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more

SQL injection

Participant ,
Jan 19, 2015

Copy link to clipboard

Copied

I have a very large website that is constantly under attack via SQL injection.

My SQL DB is corrupted weekly.

I am in the process of doing the <cfqueryparam value throughout the site.

But in the short term is there something I can add to the application.cfm if I know part of the string that is always been injected?

For example if I know that the string "www.paydayloans.com" is trying to be maliciously passed is there some code I can add to prevent that from being used in the query?

Views

198

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Jan 19, 2015 0
Advocate ,
Jan 19, 2015

Copy link to clipboard

Copied

You can definitely add code to detect specific data and execute alternative actions. This is overly simplified but something like this:

  <cfloop index="local.name" list="#structKeyList(url)#">

   <cfif isSimpleValue(url[local.name]) and reFindNoCase("(www\.paydayloans\.com|www\.somethingelse\.com)",url[local.name])>

    <cfthrow message="go away!" />

   </cfif>

  </cfloop>

An important note with this solution: it is very specific to known data and is not a good long-term solution to the problem. Definitely cfqueryparam'itize all your SQL queries.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Jan 19, 2015 0
BKBK LATEST
Adobe Community Professional ,
Jan 20, 2015

Copy link to clipboard

Copied

Through which passage is the corrupt data coming in: URL or form?

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Jan 20, 2015 0