 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 116
 Members: 0
 Total: 116
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
So Many SQL exploits/So Easy To Prevent |
|
 Posted: Tue May 10, 2005 8:42 pm |
 |
|
| accessx |
| Beginner |
 |
|
| Joined: May 10, 2005 |
| Posts: 3 |
|
|
|
 |
|
 |
|
| I'm having trouble understanding how some less popular cms/guestbooks/forums authors code without having a single SQL injection yet a large amount of the most popular apps are filled with them. Even after previous versions of their app contained similar exploits. I'm sure everyone here knows how simple it is to santize user input, but a paradox still exists. |
|
|
|
|
|
Re: So Many SQL exploits/So Easy To Prevent |
|
| Posted: Tue May 10, 2005 9:00 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| accessx wrote: | | I'm having trouble understanding how some less popular cms/guestbooks/forums authors code without having a single SQL injection yet a large amount of the most popular apps are filled with them. Even after previous versions of their app contained similar exploits. I'm sure everyone here knows how simple it is to santize user input, but a paradox still exists. |
I am not 100% agree. It's easy to use single quotes/sanityze all user submitted input/etc, but only in case of the light-weight software. If you look at source code of the much more sophisthicated pieces of software, like phpbb/vbulletin/ibb, then you can see, that 100% bughunt is impossible. Just too complicated working logic and execution flow, too many possible coincidents. So there is the point, where anti-hacking filters are handy - anti-sql-injection,anti-xss, etc. Because they are the next protecting layer, when potential attacker get's the way through sql/xss holes. I can imagine one more protection layer - NIDS - Network Intrusion Detection System, like Snort, with sql injection/xss/know exploits/worm attacks/etc pattern database. |
|
|
|
|
|
|
|
|
| Posted: Tue May 10, 2005 10:25 pm |
|
|
| accessx |
| Beginner |
|
|
| Joined: May 10, 2005 |
| Posts: 3 |
|
|
|
|
|
|
|
| That's a very good point. Thanks for the reply. |
|
|
|
|
|
Re: So Many SQL exploits/So Easy To Prevent |
|
| Posted: Thu May 12, 2005 2:02 am |
|
|
| y3dips |
| Valuable expert |
 |
|
| Joined: Feb 25, 2005 |
| Posts: 281 |
| Location: Indonesia |
|
|
|
|
|
|
| accessx wrote: | | I'm having trouble understanding how some less popular cms/guestbooks/forums authors code without having a single SQL injection yet a large amount of the most popular apps are filled with them. Even after previous versions of their app contained similar exploits. I'm sure everyone here knows how simple it is to santize user input, but a paradox still exists. |
itis quite easy but if its not a huge CMS , which as every developer or user could modify n include the module n has many feature
there still "HUMAN ERROR" behind this 
nothing perfect, btw not all programmer aware about security  |
|
_________________
IO::y3dips->new(http://clog.ammar.web.id); |
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
