Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If a website has multiple web apps, each of them connected to different tables in a database and all of the apps are protected from SQL Injection except one; can that one web app be used to read/modify/attack other tables in the database through SQL injection?

share|improve this question
    
Thank you for the wisdom and advice. –  Bob Joe Oct 22 '13 at 1:38

2 Answers 2

up vote 5 down vote accepted

Yes, depending on the underlying database security a single SQL Injection attack can affect other tables in the same database and even tables in different databases or in very specific cases tables running on different database instances.

It is even possible to update/read from multiple tables at one time using a single database query. Since you tagged your question as mysql here is a MySQL query for updating multiple tables:

UPDATE Books, Orders
SET Orders.Quantity=Orders.Quantity+2,
Books.InStock=Books.InStock-2
WHERE Books.BookID=Orders.BookID
 AND Orders.OrderID = 1002;

Reading is as simple as using a JOIN:

   SELECT t1.name, t2.otherColumn 
   FROM Table1 as t1
   LEFT JOIN Table2 as t2
   ON t1.id = t2.id

Obviously the effectiveness of these queries will depend on the underlying table structure, but you can absolutely read from unintended/multiple tables using SQL Injection.

An example of when this would not be possible is if the tables in question all belong to different schemas, each with a specific account that can access. Example:

app1.ImportantTable
app2.OtherTable
app3.BigTable

If each of these schemas is configured to only allow a different user access then there can be no unintended access. So if there is a App1User setup in the database that can only read/modify the app1 schema, it will not be able to select data from tables in the app2 schema.

share|improve this answer

It completely depends on the permissions granted to the database user the application is using to access the database.

In the best case, no, the user will not have access to any data or tables that it does not need to perform the actions the application requires it to perform. (In the very best case, it has no direct access to any tables at all, but only permissions to execute pre-defined procedures that return specific, limited data.)

In the worse case, it can not only access other tables in the database belonging to other applications, but to other databases, and to the server the database engine is running on, and to the network that the server running the database engine is connected to.

Excessive permissions granted to the user an application uses to access a database, in other words, can be very, very dangerous. It's most important to ensure that database users are appropriately restricted to only the objects and data that they actually need to access in order to perform the functions required by the application, and no more.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.