Microsoft Access SQL 注入

Question

I need to fix some security issues in a non-IT app that we were assigned to maintain. It's in Microsoft Access front-end (SQL Server back-end).

Does anyone know if SQL Injection can be done via the RecordSource or RowSource property of Microsoft Access controls? For example, if I set a listbox's recordsource to

Me.SomeListBox.Recordsource = 'SELECT * FROM SomeTable WHERE SomeField = ''' & Me.txtSomeTextBox & '''.

I'm not sure if Microsoft has built in prevention or not for those properties so I'm wondering if I should be running that Me.txtSomeTextBox through a cleaning function.

This is of course a quick fix... the application is going to be redesigned and migrated out of Access (yay!) later this year.

Thanks in advance guys!

Answer 1

Could use VBA to eliminate the obvious use of the field name in the WHERE condition.

Sub btnLogin_OnClick()

If instr(0, me.txtBox, someFieldName) > 0 Then
        Msgbox("Foo Bar!")
Else
   Login
End If

End Sub

Answer 2

如果您正在进行字符串连接，则很容易受到攻击。

Answer 3

In your case, the inject can NOT make it to sql server. Access local queries via a linked table are LIMITED to ONE sql statement. So while a “small” possible of injection into Access is possible, the sql string cannot reach SQL server as multiple sql statements, nor is running of server side SQL possible with your given example.

So the “built in prevention” is that such SQL is limited to the one string.

Because the resulting string cannot be multiple sql statements, and because the text box result is “quoted”, then you can ONLY supply a string expression as the condition, and it is NOT possible with your given example to inject sql.

If someone can post a working example of injection based on the sample VBA sql + concat of the text box, then I am all ears.

So while “some” cases of injection can occur in Access, the example you have is certainly not such a case I am aware of.

A knowledgeable user could perhaps get a VBA() function to run in that expression, but they would have to know the name of the actual VBA function. And even in this case, that would NOT execute some SQL you don't want to.

I suppose any sql string that deletes records and the value/expression is supplied by a user could be looked at, but your given example is not a typical sql injection risk.

Answer 4

Me.SomeListBox.Recordsource = 'SELECT * FROM SomeTable WHERE SomeField = ''' & Me.txtSomeTextBox & '''

You could do a wrapper, just to avoid breaking of composed SQL query eg

Me.SomeListBox.Recordsource = 'SELECT * FROM SomeTable WHERE SomeField = ''' & Replace(Me.txtSomeTextBox,"'","''") & '''

In this scenario, you add paired ' symbol ('-->''), and query won't be broken.

Answer 5

To answer your original question: it depends on the control. The List Box and Combo Box can have a Select Query as their record source. Not an action query.

The Text Box control can only be bound to a table field.

These controls are not available to any end users such that they could redefine the record source when compiled to the .accde file type.

Answer 6

String concatenation with user input is dangerous!

I setup an example. Use this SQL:

CREATE TABLE SomeTable (SomeField varchar(20), read_permission int)
INSERT INTO SomeTable VALUES ('a', 1), ('b', 1), ('c', 0)

And this VBA code:

Private Sub FilterButton_Click()
   Me.SomeListBox.RowSource = "SELECT * FROM SomeTable WHERE SomeField = '" & Me.txtSomeTextBox & "' AND read_permission = 1"
End Sub

Seemingly, you created a row based permission. Only rows with read_permission = 1 will be shown in the combobox.

But if the user enters ' OR 1=1 OR' in the textbox, he suddenly can see all data (even those rows with read_permission = 0 .

Replacing ' with '' in the user input seems to make it harder to do sql injection. I could not find any string to break it (yet). But the best idea is probably to find another way of builing the sql string.

Private Sub FilterButton_Click()
   Me.SomeListBox.RowSource = "SELECT * FROM SomeTable WHERE SomeField = '" & Replace(Me.txtSomeTextBox, "'", "''") & "' AND read_permission = 1"
End Sub