Skip to main content

protect your coldfusion site against sql injection attacks

As of this writing, a particularly virulent SQL injection spider attack is largely targeting sites running ColdFusion.

Here's how the attack appears in server logs:


The code creates a cursor of all the user tables and all the character columns in the database. It then appends a string to each of the columns, making an ungodly mess.

Mark Kruger's post goes into a great deal of helpful detail about how this spider operates. If you do a Google search on this attack, you will quickly get a feeling for how widespread this is.

If your site is getting hammered, and you need to buy time while you fix vulnerable code, there are scripts such as this one posted in ColdFusion Developer's Journal on August 8, 2008, which can be modified to thwart this most recent attack thus.

Be aware that this only buys time. The most effective course is to make sure your queries are protected with cfqueryparam. Ben Forta's primer on cfqueryparam provides a very good start on protecting code from SQL injection scripts. While you're fixing your queries, don't forget the ORDER BY clause, another frequently overlooked vulnerability.

It can be time consuming checking all your queries if you have a large amount of ColdFusion code to wade through, not to mention nerve-racking if you are doing so while the attacks are rolling in. Fortunately there are tools such as QueryParam Scanner that will peruse your code and return a list of any unprotected queries. Unzip this application and place it in a directory in the Web root of your development server. Go to the application in a Web browser, follow its directions, and you will quickly have a report of any vulnerable queries.

Popular posts from this blog

facebook, time to grow up

Originally published on August 28, 2006 I appreciate how Facebook has enabled me to connect with colleagues, and (younger) family members in a manner that is both informative and expressly cordial. It attracts students like Nutella attracts chocolate lovers, and because of that, I see interesting potential here. In fact, one of our faculty members at Penn State plans to try running his human-computer interaction course through Facebook this fall . Definitely worth pursuing.
Read more

how to make the worst of your content management system

I recently heard tell of the following activity, parading as content migration to an enterprise level content management system. I am not making this up: Copy large volumes of Web-content-to-be, page by page, into separate Dreamweaver files containing the design (created and sliced up in FireWorks) Copy/paste said Dreamweaver files into content wells of the content management system Repeat this activity ad infinitum until an entire Web presence is constructed in this fashion always crashing in the same car: recurring mistakes and misuses of the web When I heard this, something inside me snapped. Aside from the stunning inefficiency inherent in creating all these disparate Dreamweaver files, this activity points to a fundamental lack of understanding of what exactly a content managment system is. In the interest of quelling this misunderstanding in others, here follows a list of what not to do with a CMS: Dump a bad Web site into a good CMS. If your organization's Web presence is a ...
Read more

the case for incremental redesign: part ii

If you are in any way responsible for a Web site, you should have some understanding of the principles of Extreme Programming . Cultivated as a discipline of software development, it is a combination of ensuring that designs remain uncomplicated, centering changes around user requirements, and employing the concept of the "Whole Team." The result is that small changes are released as they are needed - and endorsed - by the client. Not surprisingly, Extreme Programming speaks well to Web management. Consider its core values: simplicity, communication, feedback, and courage. These are the bedrock incremental redesign. Simplicity - Integrate all site changes in small doses. Avoid tectonic disruption of the entire Web presence. Document faithfully, but do not get bogged down in over-documenting. Or overplanning. Leverage reusable objects. Better yet, get the site into a content management system - one that is scaled to its requirements. Eliminate unmanageable code morass by fol...
Read more