Web Wiz Forums - SQL code visible in page?

Print Page | Close Window

SQL code visible in page?

Printed From: Web Wiz Forums
Category: Web Wiz Web App Support Forums
Forum Name: Web Wiz Forums
Forum Description: Support forum for Web Wiz Forums application.
URL: https://forums.webwiz.net/forum_posts.asp?TID=23313
Printed Date: 07 April 2026 at 2:52pm
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com

Topic: SQL code visible in page?

Posted By: craigr
Subject: SQL code visible in page?
Date Posted: 13 May 2007 at 3:31am

I have just been notified by one of our more IT savvy users that the login SQL string is visible when they login. The address is http://www.fishing.net.nz/asp_forums/ - www.fishing.net.nz/asp_forums/ .

I've viewed the code and I cannot see it. Is there some debuging mode or way the SQL code can be captured & displayed?

Thanks is advance.

Craig

Replies:

Posted By: WebWiz-Bruce
Date Posted: 13 May 2007 at 7:02pm

The connection code will not be displayed.

If there is a problem connecting to the SQL server, they may see an error like:-

Problem connecting to database xxx using username xxx

But this doesn't revel your password and is an error coursed by the server, not the software, the only way to prevent such error messages is to disable detailed ASP error messages in the web server itself, but this can course difficulties in debugging any issues you may have running ASP on your site.

-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting

Posted By: craigr
Date Posted: 13 May 2007 at 8:19pm

Thanks Borg. Thats good to know.

However the (disgruntled) user has posted the first query in the login function in its entirety. eg select username...where handle = "" etc.

I'm currently trying to get him to let me know how he is doing it and if it's the only one he sees. Once I have his feedback I'll post what he is doing.

Cheers

Craig

Posted By: WebWiz-Bruce
Date Posted: 13 May 2007 at 8:48pm

Your login page looks like it's been modified to use the users email address instead of the username to login.

This would mean that the query your user is seeing to login is something which is not part of the original code and the user is probably using an SQL Injection to make the forum crash and display the SQL Query.

Web Wiz Forums does come with built in protection against SQL Injections, but if you have modified the code you may have accidentally removed the code that protects against SQL Injections from this query used to login users.

-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting

Posted By: craigr
Date Posted: 13 May 2007 at 8:59pm

Thats correct, but we did minimal code changes - as we didn't want to break the security.

Can you give me some further pointers on the SQL hack please? eg how I can test it. PM if necessary please

Cheers

Craig

Posted By: WebWiz-Bruce
Date Posted: 13 May 2007 at 9:31pm

The best thing to do is to findout exactly the code the person is using then use the contact us section of this site to contact support with the details of how they are doing this, we will then beable to advise you how to prevent this from happening.

-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting