The Research Of SQL Injection Against Oracle Database

Oracle database is one of the most widely used database in the world,and it accounts for a substantial share of the database market with its powerful feature and superior performance.Because of the pivotal position of Oracle database in the IT market,the issue of their security is particularly important.what the attckers always do through SQL injection is importing their own SQL code with user input in the Web page that passd to the appropritate application to perform some SQL code for non-user expected.With the SQL code ,the attackers could change,theft or destruct the database information. The attackers can even bypass the user authentication mechanism to fully control the remote sever database with SQL injection attacks. If the developer was not careful enough, the user input data may be interpreted as a database command,so remote user could excute commands in the database achiving their purpose in the process of inputing user data, and which formed the SQL Injection attacks. Especially when the application will use some user input to construct dynamic SQL statements to access the database, the more vulnerable to SQL injection attacks. Also if developers use stored procedures in the code,and these stored procedures included user input which is not limited,it is very vulnerable to SQL injection to transfer too. Once the SQL injection attack is succeed ,it could allow an attacker to use the application to log in and execute a variety of command in the database.If the attacker has achieved a very high privilege account then the problem will become even more serious. It represents a class of very serious security threat. The SQL injection vulnerability appears in the Oralce database brought serious harm to the computer network.So the depth research of the principles and how to effectively defend against the SQL injection attacks to the Oracle database has become the focus of attention.Firstly,the article defines a procedure SYS.SQLTARGET ,which exists a SQL injection vulnerability with DBA privileged user SYS in the PL/SQL Developer of Oracle database. And then we should analyze its original featrues,and give the permissions to use the procedure to the low-privileged user SCOTT.After that,we should define the attack funtions SCOTT.SQLI_CHANGPASSWORD and SCOTT.SQLI_RESTOREPASSWORD with the low-privileged user SCOTT.There are some SQL statement which could change and restore the password of the DBA privileged user SYS in the functions.Finally,we should excute the attack funtions and verify whether the modify and restore operation succeed. With the integrated process of attack,we can konw the principle and steps of SQL injection to the Oracle database in depth.And then we could summarize what we should do specifically to defend against SQL injection attacks.In the process of the SQL injection attack to the procedure SYS.SQLTARGET,in order to prevent ORA-14551:unable to perform the DML operation in a query ,we should define the attack function as an autonomous transaction with the PRAGMA AUTONOMOUS_TRANSACTION statement.At the same time,we should define the attack funtion with AUTHID CURRENT_USER statement which can be called as a creator privilege.After that,we could complete a successful SQL injection attacks to the target procedure by excuting the attack funtion.