[ news_security_news ]
Code Injection Beyond SQL
David Utter
Staff Writer
2006-11-22
 Insider Reports RSS Feed
Although SQL injection attacks have been a threat to websites, other types of code injection could be equally as toxic.
XML and LDAP could be as prone to a malicious injection of code as a SQL database on the backend of a web application. Command execution on a poorly secured application could happen as well.
Bryan Sullivan of SPI Dynamics suggested security attention should be paid to these vectors as it is for SQL injection efforts.
With XML, Sullivan gave an example of an XPath query on an e-commerce application, where failing to validate the values being sent to the application could allow someone to obtain customer details.
"With one simple request, the attacker has stolen personal data including e-mail addresses and credit card numbers for every customer that has ever used the website," Sullivan said. "Because of the forgiving nature of XPath, it can actually be easier for an attacker to use malicious code to perform an XPath injection attack than an SQL injection attack."
LDAP injection could give an attacker access to a corporate directory, with contact information and whatever other details can be found in its repository. "A hacker using this technique may rely on monitoring the absence and presence of error messages returned from the malicious code injection to further pursue an attack," said Sullivan.
Command execution probably should not be a concern in the 21st Century, but if administrators do not shut down unnecessary services, in Sullivan's example on Linux/Unix boxes, ancient commands from the dark ages of the command line could be used for evil purposes.
If someone is administering a machine somewhere that accepts the finger command over the Internet, it would be very interesting to understand why. My email address is above the article, so take a break from the turkey onslaught and let me know.
---
Tag: Code Injection
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the updates - 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
