Reply to thread

Message

<blockquote data-quote="UngainlyTitan" data-source="post: 5369163" data-attributes="member: 28487">Generally uploaded data is passed to the database. It is inserted into the database in the final step using a database language called SQL (Structured Query Language) and this is usually the place the system is most vunerable. If you can presuade the database update component to run a piece of SQL that you have passed to it, you can do a lot of damage. This is called a SQL Injection attack. Now it is possible that SQL injection attacks are possible in the CB, it is a common enough vulnerability. All data to any database should be checked to ensure that none of it can execute as SQL commands and that any possible commands are sanitised so that they are treated as plain text and not as special commands.&nbsp;A virus is normally a binary executable that hides in another file. In the case of the CB such data would be invalid of if valid (a picture, for instance) have no effect on the server since once in the database it woudl sit there inert without access the underlying OS. &nbsp;Viruses usually need access to the OS and usually need privilaged accounts which is why a lot of modern malware exploits the user in order to get permission to run.</blockquote>

[QUOTE="UngainlyTitan, post: 5369163, member: 28487"] Generally uploaded data is passed to the database. It is inserted into the database in the final step using a database language called SQL (Structured Query Language) and this is usually the place the system is most vunerable. If you can presuade the database update component to run a piece of SQL that you have passed to it, you can do a lot of damage. This is called a SQL Injection attack. Now it is possible that SQL injection attacks are possible in the CB, it is a common enough vulnerability. All data to any database should be checked to ensure that none of it can execute as SQL commands and that any possible commands are sanitised so that they are treated as plain text and not as special commands. A virus is normally a binary executable that hides in another file. In the case of the CB such data would be invalid of if valid (a picture, for instance) have no effect on the server since once in the database it woudl sit there inert without access the underlying OS. Viruses usually need access to the OS and usually need privilaged accounts which is why a lot of modern malware exploits the user in order to get permission to run. [/QUOTE]

Verification