Software Security Vulnerabilities

According to one recent study, the top three software security loopholes are mainly due to following reasons:

1. Cross Site Scipting

2. SQL Injection

3. Malicious File Execution

SQL Injection

In this type of software vulnerability, hackers try to gain the access to the application by injecting SQL code. 

Below is the simple example :

Lets say an application is giving access to the user by asking them to enter user id and password in its login screen.

But the application code is written in such a way [Concatenated user input strings] that it gives the access based on checking the below SQL statement in the backend.

SELECT FIRST_NAME FROM USERS_TABLE WHERE USER_ID = ‘’’ ||user_id_input ||’’’ and password== ‘’’ ||password_input ||’’’;

Lets say users_table in the database is having following data :

Users Table
Row Number	First_Name	Last_Name	user_Id	password
1	Mike	Tyson	mike	trickme

Now if Mike enters user id as ‘mike’ and password as ‘trickme’ then he would be allowed to enter into the website as it generates the following statement and the SQL statement retrieves the record successfully from database:

SELECT FIRST_NAME FROM USERS_TABLE WHERE USER_ID=’mike’ AND PASSWORD=’trickme’;

Output from Database

First_Name

Mike

Now lets say some hacker wants to gain access to the website and he enters

User ID = ‘’’ or 1=1 and Rownum=1--

Password = ANY PASSWORD

Then it would generate the following SQL statement and will get executed successfully (Surprisingly)

SELECT FIRST_NAME FROM USERS_TABLE WHERE USER_ID=’ ‘’’ or 1=1 and Rownum=1--’ AND PASSWORD= ‘ANY PASSWORD’;

Dissecting the above statement:

1.    SELECT FIRST_NAME FROM USERS_TABLE WHERE USER_ID=’ ‘’’  or 1=1
2.    and Rownum=1
3.    --’ AND PASSWORD= ‘ANY PASSWORD’;

First line will get FIRST_NAME of the user where USER_ID is empty or any other row

Second line will get the first row

Third line is commented so it will not get executed

Thus he always gets the first row’s FIRST_NAME from the database and thus gets entry into the website.