Synopsis
A web application displays SQL error messages.
Description
By calling discovered CGIs with previously gathered values, SQL error messages were induced.
* This could be a result of transient SQL failure :
However, even if the application is not vulnerable to an injection, SQL error messages often reveal the structure of the database and query information. Such information could help an attacker. Further, this may indicate the application is not resilient to increased traffic or unexpected data and could lead to a denial of service problem.
* They might be triggered by a 'second order' SQL injection :
Second Order SQL injection is a term used to describe an injection in which a crafted SQL query is injected into the application, but not immediately acted upon. The injected content may be stored and executed at a later time. An attacker may exploit SQL injections to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system.
Solution
- Modify the relevant CGIs so that they properly escape arguments.
- Filter error messages out.
Plugin Details
File Name: torture_cgi_sql_error_msg.nasl
Configuration: Enable thorough checks
Supported Sensors: Nessus
Vulnerability Information
Required KB Items: Settings/enable_web_app_tests