SQL Injection

[Mr Black]

>If passed variables of varchar type are not protected by cfqueryparam a hacker
can use for example

>UNION statement adding it as a part of variable that could be interpreted as

valid part of a query

>and select data from any uprotected by granted permissions tables

Any executable example to support this statement?

[CF_Oracle]

Select fieldName1 from table1
where fieldName 2 = '#form.variableName#'.

Put in passed #form.variableName# (it could be also url variable) value like
'bla-bla' UNION Select fieldName3 from table2.

Works with Oracle if no cfqueryparam around #form.variableName#.

[Mr Black]

Nop. This doesn't work. The entire entry is treated as a char value, not like two independent SQL statements. Any better example?

[mxstu]

Originally posted by: CF_Oracle
Works with Oracle if no cfqueryparam around #form.variableName#.


I tried it with MX 6.1 and a few different databases (not oracle) and drivers
and the single quotes were always escaped. What version of MX, oracle and
drivers are you using?

If however, the statement uses #PreserveSingleQuotes()# or was an numeric
value (ie. no single quotes around the #variable#), then sql injection was
possible.

[CF_Oracle]

Oracle9i, CF&. Yes, I used PreserveSingleQuotes since text fild values included apostrofe sometimes. Thanks mxtu.