Re: Web Site Vulnerabilities

> One was subject to a basic SQL injection attack to log in to their 
> customer side, and the other was displaying ASP code in the page that
> listed not only various function definitions, but login, URL and 
> passwords (including sa) for their database.

Sounds like the managers in question aren't realizing that the problem
with sql injection isn't *just* that their data is exposed, but that
sql injection *is* code injection. And code can be wrangled to do
anything. For example on a ms sql box you could run xp_cmdshell or
create activex objects, etc, etc, etc. It's a buffer overflow without
the need to find the buffer!

Chances are also good that the sa password you uncovered is also a
password for some other juicy admin account...



=====
Jeff
=====
It's a small world, but I wouldn't want to paint it.
--Steven Wright