SQL Injection Attacks

• login to the application without supplying valid credentials
• perform queries against data in the database
• modify the database contents or drop the database altogether

Structured Query Language (SQL) is a textual language used to interact with relational Databases. Applications often use SQL statements to authenticate users to the application, validate roles and access levels, store and obtain information for the application and user, and link to other data sources.

SQL Injection flaws allow attackers to relay a malicious code through a web application to another system. This is done through calls to backend databases using SQL queries. To exploit a SQL injection flaw, the attacker must find a parameter that the web application passes through to a database. By carefully incorporating malicious SQL commands into the content of the parameter, the attacker can manipulate the web application into forwarding a malicious query into the database.

The consequences are particularly damaging, as a successful attack may get the database to run undesirable commands, resulting in disclosure of confidential information, database modifications or even database shutdown.

Using SmartView Tracker, users of VPN-1 NG with Application Intelligence R55W, users of VPN-1 NGX R60 and users of Connectra that have enabled the Web Intelligence SQL Injection protection mentioned below, will identify SQL Injection attacks by the following entries (example only):

Attack name: SQL Injection
Information: reason: WSE0040001 SQL injection detected in URL: 'UNION'

Users of VPN-1 NG with Application Intelligence R55W, users of VPN-1 NGX R60 and users of Connectra with Web Intelligence license are protected against SQL Injection attacks.

Web Intelligence can inspect for the presence of SQL commands in web forms or URLs sent in HTTP requests to a server. The protection looks for several categories of commands, including distinct SQL commands (i.e. strings that are unique to SQL), non-distinct SQL commands (i.e. strings that may appear in common language, such as "select", "join" etc), as well as special SQL separator characters (+ ' -).

To enable the Protection (R55W, R60):

Select the Web Intelligence tab > Application Layer and check SQL Injection.

To enable the protection (Connectra):

1. On the navigation tree, click Security > Web Intelligence
   
   
   
   
2. The Web Intelligence page appears. The Application Layer Protection pane is shown below:
   
   
   
   
3. In the Application Layer Protection, enable SQL Injection. Select a Security Level from the Security Level drop-down box.