All geek questions in one place

Are ASP.net __EVENTTARGET and __EVENTARGUMENT susceptible to SQL injection?

A security review was conducted for one of our ASP.net applications, and SQL Injection Exposures, which are considered high-risk, were returned in the test results.

The test passed the SQL statement as the values ​​__EVENTTARGET and __EVENTARGUMENT. I am interested, since these 2 values ​​are ASP.net automatic generated hidden fields used for the Auto-Postback function in the structure, and contain information related to the controls that trigger the postback, is there really potential for SQL injection if you never manually calling or pulling values ​​from these parameters in your code?

+3
source share
2 answers

.. if you never manually call and or pull values ​​from these parameters in your code behind ...

Assuming the above statement is true, I don’t see that these parameters are susceptible to SQL Injection. Perhaps you started an automatic scan, and this is a false signal?

+1
source

You should always assume that dirty data may be submitted from your form. By allowing it to load from the postback, __EVENTARGUMENT can be modified on the client side via javascript.

, , SQL-; SQL .

http://msdn.microsoft.com/en-us/library/ms998271.aspx

+2

Source: https://habr.com/ru/post/1739897/

More articles:


All Articles