Local security company Sensepost has uncovered a serious security hole for machines running Microsoft SQL connected to a Web site. The exploit can completely compromise the server and lead to further exploitation of other boxes.
Calling the method "SQL insertion", Haroon Meer, technical specialist, Sensepost, published a paper on Sensepost`s site with a description of the problem and examples of how the exploit works.
SQL insertion occurs when input from a Web form is not validated, allowing malicious code to execute through an SQL command. A hacker can gain full systems-level access to the machine with this method.
The problem can be used to gain access to password-protected sites, to get user names and passwords for the SQL server, for opening ports on the box (such as a Telnet port), or to open a command prompt on the victim`s machine with systems-level permissions.
"People have been screaming about poor (non) validation of user input for as long as I can remember, so I don`t even think that any of the normal excuses apply anymore," says Meer in his paper. "By now developers should simply have learnt that `all user input should be inherently distrusted` and therefore sanitised. Unfortunately most of the sites you come across seem to ignore sanitisation of user input completely or do it selectively, often forgetting hidden fields."
Sensepost has demonstrated this exploit to ITWeb.
Related links:
Share
