Stranage SQL注入 [英] Stranage SQL injections
问题描述
我的网站是经典ASP作为前端，SQL Server 2005作为后端。
但是我的后端面临一个非常奇怪的SQL注入。
带有垃圾邮件站点的HTML的某种类型的CSS将他们的代码附加到我的网站数据库中，每个表和每个varchar类型列。
例如
I have website as Classic ASP as Front end and SQL Server 2005 as Back end.
But I am facing a very strange SQL injection on my back end.
Some type of CSS with HTML with spamming site is appending their code to my website database with each table and with each varchar type columns.
For e.g.
</title><style>.am1y{position:absolute;clip:rect(405px,auto,auto,405px);}</style><div class=am1y>same day <a href=http://mazzpaydayloans.com >payday loans</a></div>
我检查了我的IIS日志它显示我这样
2013-06-09 19:15:54 GET /mypage.asp%3C/title%3E%3Cstyle%3E.axo5{position:absolute;clip:rect(404px,auto,auto,404px);}%3C/ style％3E％3Cdiv％20class = axo5％3Eapproval％20％3Ca％20href = http：/mazzpaydayloans.com%20%3Epayday%20loans%3C/a%3E%3C/div%3E - - 204.13.205.99 HTTP / 1.1的Mozilla / 4.0 +（兼容; + MSIE + 6.0; +窗口s + NT + 5.1; + SV1）loginfailure = chance = 0& bantime =; + ASPSESSIONIDSSDRRCQQ = EDPHPJGCGLMKOADICKHODKBM - www.mysite.com 404 0 281 543 78
开我选择的这个ASP页面所有的SQL查询都是参数化的。
但这个问题仍然存在。
I Checked My IIS Log It shows me like this
2013-06-09 19:15:54 GET /mypage.asp%3C/title%3E%3Cstyle%3E.axo5{position:absolute;clip:rect(404px,auto,auto,404px);}%3C/style%3E%3Cdiv%20class=axo5%3Eapproval%20%3Ca%20href=http:/mazzpaydayloans.com%20%3Epayday%20loans%3C/a%3E%3C/div%3E - - 204.13.205.99 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1) loginfailure=chance=0&bantime=;+ASPSESSIONIDSSDRRCQQ=EDPHPJGCGLMKOADICKHODKBM - www.mysite.com 404 0 281 543 78
On my this selected ASP Page all SQL queries are parametrized.
But still this issue is persists.
推荐答案
我强烈建议您参考以下链接，我回答了类似的问题。虽然它在ASP.NET中，但你仍然可以通过非常有用的提示。这对你将来也有好处。
我的网站中的SQL注入会影响我的数据库数据 [ ^ ]
I strongly recommend you to refer to below link where i answered the similar question. Though its in ASP.NET,still you can go through very useful tips.That will be beneficial for you in future also.
sql injection in my website which effect my database data[^]
这篇关于Stranage SQL注入的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
