Oh the Irony.... Email causes SQL injection in help desk ticket software

Forums › IT Pro and developers › Oh the Irony.... Email causes SQL injection in help desk ticket software

1 | 2

tripp

3848 posts

Uber Geek
+1 received by user: 1220

Trusted

Lifetime subscriber

#2499189 5-Jun-2020 17:10

I don't know the helpdesk system but seems like the "description" is almost like a header subject line with no history on it, front end just does the update to the field without any kind of history of what was in there before. Not the best thing but I can understand the thinking around it.

freitasm

BDFL - Memuneh
80646 posts

Uber Geek
+1 received by user: 41029

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2499194 5-Jun-2020 17:17

nztim:

frankv:

My reading of it is that the intended SQL statement was something like

UPDATE table SET description TO ';-- ...' WHERE field = ';-- ...'

but what actually got executed was

UPDATE table SET description TO ';-- ...'

I guess my question remains, why is the software frontend updating database tables? Surely it just needs to SELECT FROM or INSERT INTO ??

I'd have thought that updating descriptions is one of the many functions the software frontend would perform. People change descriptions, subjects, etc.

Another way would be each column on its own table and doing inserts - the frontend would only ever show the latest record for each column. Surely this is not what you suggest?

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

tripp

3848 posts

Uber Geek
+1 received by user: 1220

Trusted

Lifetime subscriber

#2499199 5-Jun-2020 17:27

freitasm:

I'd have thought that updating descriptions is one of the many functions the software frontend would perform. People change descriptions, subjects, etc.

Another way would be each column on its own table and doing inserts - the frontend would only ever show the latest record for each column. Surely this is not what you suggest?

If you had the header table insert each time there is a change you would get history of the change but it would be awful on resources and the database as you would just be repeating row data each time. Unless it's something like SAP hana which is column store. But that is getting off the subject :P

freitasm

BDFL - Memuneh
80646 posts

Uber Geek
+1 received by user: 41029

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2499200 5-Jun-2020 17:31

tripp:

... it would be awful on resources

Exactly.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

1 | 2