Detecting SQL Injection with ScriptProtect
It occurred to me this morning that ScriptProtect can be a handy feature for globally catching a few forms of SQL Injection Attacks
WARNING - just like its inability to protect against all forms of XSS attacks this solution DOES NOT protect you from all SQL Injection attacks.
You can edit, and add the regular expression patterns for the scriptprotect feature in ColdFusion MX 7 by editing
neo-security.xml located in
WEB-INF/cfusion/lib. Add the following pattern under the default cross site scripting pattern.
<var name=";.*(select|insert|update|delete|drop|alter|create)"> <string>SQL_INJECTION_ATTEMPT</string> </var>
I first tried just using a
; as the pattern - but that caused problems with some of the variables in the CGI scope (things like User Agent often have semi-colon's in them). So the pattern now looks for a semi-colon followed by zero or more characters followed by a select, insert, update, delete, drop alter or a create.
Don't expect to catch all possible SQL Injection attacks with this, so don't trust it to stop them. I'm just posting this FYI.
- Devnet Article on Securing CF From SQL Injection - April 9, 2009
- ScriptProtect in ColdFusion MX 7 not a catch all - May 17, 2005
- Mastering CFQUERYPARAM - July 24, 2008
- Announcing Web Application Firewall for ColdFusion - July 9, 2007
- CFPARAM for Simple String Validation - May 29, 2007
- Updating Java on ColdFusion or Lucee
- ColdFusion returning empty response with server-error: true
- Careful applying CF11u16, CF2016u8, CF2018u2
- Sessions don't work in Chrome but do in IE
- csrfVerifyToken does not invalidate the token
- The cf_sql_ is optional in cfqueryparam
- Cookie Expires / Max-Age 1969-12-31T23:59:59.000Z
- Burst Throttling on AWS API Gateway Explained