Are statistical databases vulnerable to SQL injection attacks? If so, what specific kind? Can you think of an example?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
||||
|
|
I might be mincing terms here, but technically no, a statistical database shouldn't be vulnerable to SQL injection, because statistical databases tend not to use SQL as its query language. They tend to use variants of the language like MDX or DMX. Then again, some do support SQL though so... However, since they do accept input in the form of a language they certainly can be vulnerable to injection because its not really up to the database or its server to prevent injection. Its up to the application calling into the database to properly protect against injection. There are varying degrees of damage involved here too. In most cases you can't insert data or delete data as these databases/cubes/models tend to be read only, however it could be possible to change the intended result set and get more information than expected. I would expect this to be possible in poorly developed reporting applications. |
|||
|
|
|
If by "statistical" you mean "zero inputs" then the answer is: no. But if this is an SQL DB that accept inputs (i.e. even for filtering purposes) than all standard rules still apply, and its as vulnerable as any other SQL DB. |
|||
|
|
