Example Sins

The following entries on the Common Vulnerabilities and Exposures (CVE) web site (http://cve.mitre.org) are examples of SQL injection.

CAN-2004-0348

From the CVE description: SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter.

Many scripts in SpiderSales software dont validate the userId parameter, which can be used to perform SQL injection attacks. Successful exploitation allows an attacker to gain access to SpiderSales administrator interface and read any information from the stores database.

CAN-2002-0554

From the CVE description: IBM Informix Web DataBlade 4.12 allows remote attackers to bypass user access levels or read arbitrary files via a SQL injection attack in an HTTP request.

The Web Datablade Module for Informix SQL dynamically generates HTML content based on data. A vulnerability was reported in some versions of Web Datablade. It is possible to inject SQL commands into any page request processed by Web Datablade. This may result in the disclosure of sensitive information or increased access to the database.