CGI Generic 2nd Order SQL Injection Detection (potential)

high Nessus Plugin ID 48926

Language:

Synopsis

A web application displays SQL error messages.

Description

By calling discovered CGIs with previously gathered values, SQL error messages were induced.

* This could be a result of transient SQL failure :

However, even if the application is not vulnerable to an injection, SQL error messages often reveal the structure of the database and query information. Such information could help an attacker. Further, this may indicate the application is not resilient to increased traffic or unexpected data and could lead to a denial of service problem.

* They might be triggered by a 'second order' SQL injection :

Second Order SQL injection is a term used to describe an injection in which a crafted SQL query is injected into the application, but not immediately acted upon. The injected content may be stored and executed at a later time. An attacker may exploit SQL injections to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system.

Solution

- Modify the relevant CGIs so that they properly escape arguments.

- Filter error messages out.

Plugin Details

Severity: High

ID: 48926

File Name: torture_cgi_sql_error_msg.nasl

Version: 1.20

Type: Remote

Family: CGI abuses

Published: 8/30/2010

Updated: 4/11/2022

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Vulnerability Information

Required KB Items: Settings/enable_web_app_tests

Detections

Analytics