Detections
Analytics

SQL Injection Authentication Bypass

high Web App Scanning Plugin ID 113069

Language:

Synopsis

SQL Injection Authentication Bypass

Description

Due to the requirement for dynamic content of today's web applications, many rely on a database backend to store data that will be called upon and processed by the web application (or other programs). Web applications retrieve data from the database by using Structured Query Language (SQL) queries.

To meet demands of many developers, database servers (such as MSSQL, MySQL, Oracle etc.) have additional built-in functionality that can allow extensive control of the database and interaction with the host operating system itself.

An SQL injection occurs when a value originating from the client's request is used within a SQL query without prior sanitisation. This could allow cyber-criminals to execute arbitrary SQL code and steal data or use the additional functionality of the database server to take control of more server components.

The successful exploitation of a SQL injection can be devastating to an organisation and is one of the most commonly exploited web application vulnerabilities.

This injection was detected as scanner was able to bypass the authentication mechanism and access an authenticated page.

Solution

The only proven method to prevent against SQL injection attacks while still maintaining full application functionality is to use parameterized queries (also known as prepared statements). When utilising this method of querying the database, any value supplied by the client will be handled as a string value rather than part of the SQL query.
Additionally, when utilising parameterized queries, the database engine will automatically check to make sure the string being used matches that of the column. For example, the database engine will check that the user supplied input is an integer if the database column is configured to contain integers.

See Also

http://en.wikipedia.org/wiki/SQL_injection

http://projects.webappsec.org/w/page/13246963/SQL%20Injection

http://unixwiz.net/techtips/sql-injection.html

http://www.securiteam.com/securityreviews/5DP0N1P76E.html

http://www.w3schools.com/sql/sql_injection.asp

https://www.owasp.org/index.php/SQL_Injection

Plugin Details

Severity: High

ID: 113069

Type: remote

Family: Injection

Published: 12/6/2021

Updated: 7/6/2023

Scan Template: pci, scan

Risk Information

VPR

Risk Factor: High

Score: 7.2

CVSS v2

Risk Factor: High

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:P

CVSS Score Source: Tenable

CVSS v3

Risk Factor: High

Base Score: 8.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CVSS Score Source: Tenable

CVSS v4

Risk Factor: High

Base Score: 7.2

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L

CVSS Score Source: Tenable

Reference Information

CWE: 89

OWASP: 2010-A1, 2013-A1, 2017-A1, 2021-A3

WASC: SQL Injection

CAPEC: 108, 109, 110, 470, 66, 7

DISA STIG: APSC-DV-002540

HIPAA: 164.306(a)(1), 164.306(a)(2)

ISO: 27001-A.14.2.5

NIST: sp800_53-SI-10

OWASP API: 2019-API8

OWASP ASVS: 4.0.2-5.3.4

PCI-DSS: 3.2-6.5.1