SQL Injection via table name?

Question

Is it possible to perform SQL injection on a query where the name of the table is passed in as an argument? The user doesn't enter the table name themselves, but it can be inferred through element IDs. I am using Microsoft SQL Server 2012 with Coldfusion 10, if that helps.

Example:

SELECT * FROM [Database].[dbo].[#tableName#]

Could the #tableName# parameter be used to inject malicious code?

Also, could the parameter names be vulnerable to injection as well?

Second example:

SELECT * FROM [Database].[dbo].[#tableName#] WHERE [#paramName#] = '#paramValue#'

The second example assumes the use of Coldfusion's cfqueryparam for setting the #paramValue#, so the question is more geared towards the use of [#paramName#].

Answer 1

Yes. I'm assuming that you are building your query with string concatenation.

Let's take

SELECT * FROM [Database].[dbo].[#tableName#]

If you replace #tableName# by employee]; DELETE FROM [Database].[dbo].[employee you then obtain 2 queries

SELECT * FROM [Database].[dbo].[employee];
DELETE FROM [Database].[dbo].[employee];

There is only one way to fix SQL Injection : use parametrized queries.