verify how your scanner determines the vulnerability.
I have used one that attempts to hit the page with valid data and gets the
response.
Then they attempt to exploit and check the response. If the data that
they send has no effect on the response from the server, they conclude
that their exploit might have been successful.
That's exactly what is happening here, and the code appears to be solid
and there does not appear to be an issue. Get your security folks to flag
this as a false positive in their scanning tool. The extra bits that get
passed in are tossed on the floor and not used, they have no effect and
are not a security issue.
stewart
Perhaps someone more familiar with security can help me with this? Or
perhaps it's a false positive? We scan or hosts for security and my
score just went up more than three fold. This was the worst offender:
wpoison (nasl version)
Long Desc: The following URLs seem to be vulnerable to BLIND SQL
injection
techniques :
/hobbit-cgi/bb-hostsvc.sh?-='+AND+'b'>'a&HOST=myhost&SERVICE=info
Obviously Hobbit doesn't use SQL, but we do have a running mysql
instance running on the host. Our mysql instance is not used by hobbit.
Any suggestions?
Our mysql instance:
mysql Ver 14.12 Distrib 5.0.27, for redhat-linux-gnu (i686) using
readline 5.0
~David
--
Stewart Larsen