Again and again hackers use SQL injection to get information from the backend database. Is it fair to say because a relational database by its nature has all the links within the data sets (e.g., 1-to-1, 1-to-* and so on), therefore it enables a user with any form of access to illegally access everything, either in theory or practice?

  • 2
    The amount of other information compromised in the Ashley Madison attack (internal documents, network diagrams) makes it tremendously unlikely that it was a SQL injection attack. – gowenfawr Aug 19 '15 at 23:14
  • I wrote an article about possible attack vector regarding ashleymadison hack. linkedin.com/pulse/… – Michal Koczwara Aug 20 '15 at 1:41
  • @MichalKoczwara you also wrote about it here: security.stackexchange.com/q/97293/6253 – schroeder Aug 20 '15 at 4:20
  • @shroeder no this is a different crossdomain. – Michal Koczwara Aug 20 '15 at 5:30

How data is related or not within the database has nothing to do with SQLi. Flat files, NoSQL, etc. will not affect the ability for a user to perform unauthorized access to data.

SQLi is about unsecured direct access to the database (in whatever form that is), resulting in a user manipulating that access in order to obtain data without the expected authorization.

| improve this answer | |
  • Authentication on NoSQL seems to be worse partially due to default authentication being remarkably trusting. – lloyd Aug 19 '15 at 22:39
  • 2
    yeah - I wasn't going to poke holes in the inherent security of the various database technologies because the question was more about SQLi in general. – schroeder Aug 19 '15 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.