Considering that I have a structure like the following, allowing only the TCP and UDP ports for SQL to be accessed. Specifically no traffic initiated from SQL is allowed to reach SECURE.

     |-> SECURE-SQL 

What kind of attacks are there out there to compromise SECURE - and therefore eventually SECURE-SQL - , assuming that the server SQL is compromised? I've read about a lot of attacks, but not anything really covering jumping from SQL to a web server when you don't have direct network access.


A stored XSS attack could do this. If the web site is not properly encoding data from SQL when output to the client, then the client-side script code could attack another user (possibly an admin user) and access details or write to data stored in SECURE-SQL if there's an appropriate mechanism within the web site's functionality to enable this.

A "second order" SQL Injection attack could also do this. This is where data retrieved from the database is used in another query without properly encoding the data or without using parameterised queries. Character sequences such as those containing single quotes can cause the executed query to change and attack the database that is queried with this data. If the web site uses data from SQL in queries on SECURE-SQL then this may be possible.

  • Great input. I was thinking some kind of memory based attack against the app server. A client side attack against an admin user is a vector I had not considered. – Tim Brigham May 19 '14 at 2:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.