IIS 6.0 服务器和 Unicode 字符
我们正在对使用 MS SQL 数据库的简单 asp 应用程序执行笔测试。对于身份验证，他们似乎使用动态构造的查询，但转义单引号。 当我们使用 Unicode 引号（如 %uFFO7、%u02b9 等）时，我们能够成功注入 SQL 注入。 想了解是否更多的是 IIS 服务器对 Unicode 字符进行规范化的配置问题，或者转义单引号的验证函数的编写方式是问题的原因？
We are performing a pen test on a simple asp application that uses MS SQL Database. It seems for the authentication they are using dynamic constructed queries but escaping single qoutes.
When we use Unicode quotes like %uFFO7,%u02b9 etc we are able to successfully inject SQL injections.
Want to understand is it more a kind of configuration issue of IIS server to cannonicalize Unicode characters or the way the validation function to escape single quotes is written is the cause of the problem?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
有 ASP 代码示例吗？据我了解，编码是由 IIS 完成的，但那是为了传输，实际上不会被看到，所以它们的转义功能可能有缺陷。如果他们构建动态 SQL 字符串而不是使用存储过程（无论如何，存储过程不会关心引号，但会接受它们作为文字字符），则尤其如此。
Do you have a sample of the ASP code? As I understand it, the encoding is done by IIS, but that's for transport and wouldn't be seen, really, so their escape function is likely flawed. This is particularly true if they're building dynamic SQL strings rather than using a Stored Procedure (which wouldn't care about the quotes, in any event, but would accept them as literal characters).