Fergie's Tech Blog

How One Site Dealt With SQL Injection Attack

Ellen Messmer writes on NetworkWorld:

The massive wave of SQL injection attacks that started striking Microsoft-based Web sites around the world more than a week ago claimed as one of its victims Autoweb, a U.K.-based advertising and marketing site.

The ongoing attack, which hit Autoweb on a late Friday, exploited a vulnerability in a single line of code in the Web application to pierce through to the company’s Microsoft SQL database, inject 30 characters to overwrite content, defaced Web pages, and ultimately knocked the site offline. The attack left Web pages that would attempt to inject malicious code into browsers of Web visitors.

t is estimated that at least a half-million Web pages had been infected in a similar style since it was flagged by security experts April 24. How Autoweb had to fight to recover its site over the long weekend that followed shows how devastating SQL injection attacks can be.

posted by Fergie @ 5/02/2008 12:08:00 AM