Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a desktop based software that's built on top of SQL 2005. The SQL server is hosted inside my office, and there is 1 public facing website which displays some of the content from this database.

The problem i have

  1. The following HTML code has been injected into the description column for every single record in 1 of the tables for my database

<div style=position:absolute;top:-9999px;><a href= >cash fast</a><a href= >guaranteed payday loans</a><a href= >instant cash</a><a href= >payday loan store</a><a href= >payday lending</a></div>

  1. I did a google search just for the link and it appears that several other sites have the same exact HTML string in their database that even shows up on their public website.

My Questions is

How could this have happened ? Only port 80 is exposed for the HTTP server (IIS 7.5) and that server connects to the database using it's internal IP only. The SQL server is not exposed to the public. The desktop client application is run on 8 employee computers and these people are using Windows 7 computers in lock down mode with zero admin rights. They can't install applications with admin approval.

The public website is for viewing only, there is no method to update data from the public site.There is no way for anyone on the internet to update or enter data into the database.

Where should i start looking for holes in my security ?


share|improve this question

It is, as your header suggests, very likely that this is caused by SQL injections (but without seeing more of your actual code for the website, it's really impossible to say...).

To troubleshoot, you want to look at the code which serves data for your website. I assume you get some sort of input, a search string or something, from the user and then use that to choose what data to display - in that case, you should look at how those choices are made. Are you filtering with something like sqlstring = "SELECT * FROM table WHERE somecolumn LIKE %'" + searchstr + "'"? If so, you're open to SQL injections. It doesn't have to be this obvious either - there are many mistakes one can make that exposes the database...

Regardless of how this happened in the first place, there is one simple and extremely forceful way to prevent it from ever happening again: make sure that the account the web site uses to get data only has read access to the database. If you need, create a new user in SQL Management Studio, give that user read-only privileges on the tables it needs (and no more!), and change the connection string in the website configuration to use the new account instead. That way, it doesn't matter how bad the rest of the code for the website is - users accessing your database from the web interface could never store anything in the database anyway.

share|improve this answer
Great, you have given me somewhere to start. I suspect you are correct and will verify soon. – Khalid Rahaman Oct 3 '12 at 23:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .