Weird entry in SQL Server database, is this a result of SQL Injection?

Question

I stumbled upon a case where several database entries were updated. And the update is rather unusual.

For example if I have an entry named:

Watermelon

The updated version is:

Watermelon<IMG SRC="/WF_SQL_XSRF.html">

The WF_SQL_XSRF.html file is not in the server, nor it was from internal people. I did google and only a single Korean forum mentioned this and said "Watch your security." But I didn't find a single relevant documentation about this WF_SQL_XSRF thing. I know that the word XSRF is not a good sign already, but I just want to know what tool this might come from and is it common to have one.

I also find several other unattended website that has this line:

https://dried-food.foodporno.xyz/id/kotor-martini-resep-reddit/

References: http://www.erel.kr/bbs/board.php?bo_table=study&wr_id=247&sfl=mb_id%2C1&stx=admin&page=2

Answer 1

This doesn't look like a SQL Injection attack to me. A SQL injection attack would contain SQL keywords like select, update, delete, drop, etc.

But, it does look like user input is not being sanitized properly before being written to the database, and this could open the door to other types of attacks such as XSS attacks.

So, you might want to take this as a sign that a security checkup might be in order. In addition to looking into how your application sanitizes and/or escapes user input before writing it to the database - you might also want to be sure that all content originating from external sources is written to DOM elements using .innerText() (not .innerHTML). This way, if the content contains any dangerous tags (such as <script> tags), these will not be executed. You might also want to implement a restrictive content security policy (CSP) as another measure to mitigate these types of attacks.

Answer 2

WF_SQL_XSRF.html is the payload of an HCL AppScan Standard link injection test. AppScan appends the payload to parameters and then submits the request. It is possible the parameters are processed all the way through to the database.