How to handle the SQL injection response for best practice

Question

We are using the web security scanner which found out one of my web page has a Bind SQLi. The scanner modified the parameter "news.aspx?id=123" to "news.aspx?i=123' or 1=1--", And the web server responses to the news information for id=1 information currently.

After investigation from development team, they said that there's no injection cannot access to Database which has already blocked by the .NET Built-in API SQL Parameter, and the back-end program will auto return the data of id=1 information to client side.

May I know can it be identified as false positive, or is it better to redirect to generic error pages? Or it is enough and acceptable for current stage?

Answer 1

the back-end program will auto return the data of id=1 information to client side.

IMO, this is a lame behavior for the backend. I'd say the page should detect the error and redirect the user to an error page. Nevertheless, based on that description it is not a valid injection, so if the business can accept that behavior, then it is a false positive.

PS While this isn't a SQL injection, it is potentially an information disclosure bug if it's possible to get the page to display the data for id=1 and the user of the page shouldn't have access to that particular record.

Answer 2

只要您的基础应用程序代码对要发送给SQL的值进行参数化（如开发人员所言），那么您就不必担心此类警告。