1. Theodore Lawson CSCE548 Student Presentation, Topic #2
CWE-89 SQL Injection
Theodore Lawson
CSCE548 Student Presentation, Topic #2

2. Technical Overview
Software constructs part of SQL commands from user-controllable inputs
Software does not clean up elements from user that could end up modifying components downstream
User inputs may alter logic to bypass security checkpoints, or insert statements that modify the back end database

3. Technical Overview Weakness Prevalence
High
SQL makes no distinction between the control and data planes.
Mitigation Cost
Low
proper architecture and design.
Attack Frequency
high
flaw is very easy to detect and exploit.

4. Technical Overview Consequences Data Loss Security Bypass
Ease of Detection
Automated Static Analysis
Manual Analysis
Attacker Awareness
High
Common flaw in data-rich applications

5. Examples Code intends to execute:
SELECT * FROM items WHERE owner = <userName> AND itemname = <itemName>;
If the attacker with the username Ted enters the string:
name' OR 'a'='a
Query becomes
SELECT * FROM items WHERE owner = ‘ted' AND itemname = 'name' OR 'a'='a';
Which always evaluates true, and essentially becomes
SELECT * FROM items;

6. Examples Confidentiality Loss of sensitive data Authentication
Access account of other users
Authorization
Improper changing of information
Integrity
Delete information

7. Detection Methods Automated Static Analysis Advantages False Positives
False Negatives
Manual Analysis
Disadvantages

8. Avoidance of Error Using proper languages, libraries, and frameworks
Hibernate
Enterprise Java Beans
Separation between data and code
Principle of Least Privilege

9. Conclusion Importance Easily exploited Easily avoided Relevance
Potential damage
Attacker awareness
What we can do
Be aware
Use tools to detect

10. References 2011 CWE/SANS Top 25 Most Dangerous Software Errors
Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection’)
SQL Injection Examples