SQL Injection threat with APEX developed applications

We are using a tool, HP WebInspect, to scan some of our APEX developed applications for web application security testing and assessment. We are getting some critical and high vulnerabilities identified (see below) and would like to know if someone else has encoutered these and to determine a solution, whether it be a setting/settings within APEX or is it more related to the application and the way it was developed.
Critical:
Possible SQL Injection
File Names: • https://xxx.edu:443/pls/apex/f?p=4550:1:36080644498857::NO:4::&success_msg=If+7
77-777-1911form%40value777.com+exists+in+our+records'+OR%2cwe+will+send+the+workspace+name
s+associated+with+this+email+address.+If+you+are+having+problems+receiving+the+workspace+name
s%2cplease+contact+your+administrator.%2fC34A0EF5494AB92C95AA4D0F7BF52332%2f
• https://busaff-test.utdallas.edu:443/pls/apex/f?p=4550:1:36080644498857::NO:4::&success_msg=If+7
77-777-1911form%40value777.com+exists+in+our+records%2cwe%2bwill%2bsend%2bthe%2bworkspace
%2bnames%2bassociated%2bwith%2bthis%2bemail%2baddress.%2bIf%2byou%2bare%2bhaving%2bprob
lems%2breceiving%2bthe%2bworkspace%2bnames'%2bOR%2cplease+contact+your+administrator.%2fC3
4A0EF5494AB92C95AA4D0F7BF52332%2f
High:
Possible Username or Password Disclosure
File Names: • https://xxx.edu:443/pls/apex/f?p=104:101:1328157658320206:&notification_msg=Invali
d%20Login%20Credentials/156F2A38AC41E25732821ABED8AA98B6/
• https://xxx.edu:443/pls/apex/f?p=104:101:2360963243212364&notification_msg=Invali
d%20Login%20Credentials/156F2A38AC41E25732821ABED8AA98B6/

You can help us by telling us your first name, putting it into your profile, and by selecting a friendlier handle.
The details you showed indicate no SQL injection possibilites whatsoever. The "Critical" examples also are unrelated to Application Express applications that you may have developed (application 4550 is the login application for the product itself and should rarely be used by end users in production environments).
Scott

Similar Messages

SQL Injection detection with IDS/IPS on cisco ASA?

Hi
Is it possible to detect or prevent SQL injection attacks using Cisco IDS/ IPS on ASA or with regular expressions?
Is there any signature available in IDS/IPS for this? And how effective it is in terms of generating correct alarms?
Thanks in advance

Deepak,
We have several signatures that detect generic SQL injection attacks in the 5930-x family of signatures.

NEED SQL SYSTAX RESTRICTION FOR APEX DEVELOPEMENT

GOOD DAY MASTER..!!!
I HAVE LITTLE PROBLEM IN SQL.
I GOT VIEW(ITEMS_IN_SALES2)
" SELECT INV_NO,
ITEM_NO,
ITEM_NAME,
PRICE,
QTY_INV,
NO_SOLD,
QTY_LEFT
FROM ITEM_IN_SALES
WHERE QTY_LEFT > 0;"
AND IT'S RUNNING FINE..
THIS IS FOR ME TO GET ALL THE DATA IN INVENTORY(WHERE I GET THE SOURCE OF VIEW)
IN THIS VIEW ITS POSSIBLE TO COLLECT THE DATA WITH DUPLICATE ITEM_NAME & ITEM_NO BUT DIFFERENCE INV_NO
AND WHEN I RUN THE VIEW THIS IS THE RESULT
INV_NO ITEM_NO ITEM_NAME
1 20 POWDER
1 21 OIL
2 20 POWDER
2 19 BABY OIL
SEE THE DUPLICATE ITEM_NAME & ITEM_NO BUT DIFFERENCE INV_NO
WHAT I WANT TO ACHIEVED IS THIS RESULT
1 20 POWDER
1 21 OIL
2 19 BABY OIL
IS THAT POSIBLE? TO ABLE THE VIEW TO PICK THE ONLY 1ST INV_NO?
TO PREVENT DUPLICATE
PLEASE HELP MASTER..
REGARDS
MIKE.PILAPIL

Hi Michael,
For the above mentioned output,
You can try something like this,
SELECT distinct INV_NO,ITEM_NO,ITEM_NAME from invoice where inv_no not in (2)
union
SELECT distinct INV_NO,ITEM_NO,ITEM_NAME from invoice where item_no not in(20) and item_name not in ('POWDER')its only for the output which you mentioned.
1                      20                   POWDER
1                      21                   OIL
2                      19                   BABY OILThank you.
Edited by: Gurujothi on May 17, 2012 2:59 AM

SQL injection hacks

Hi,
i am a bit disappointed by the ability of cisco IPS to block sql injections, even with the new added generic sql injection signatures not long ago, still websites hosted with us are being hacked.
i know its vulnerabilities in the sites, but the command update is a lot used to hack sites, i have created a custom signature that catches "update" in small and caps, but i was surprised yesterday that the hacker used "u%pdate" and it bypassed the sensor !!
any thoughts on the subject
thanks

Interesting. I'm so not a SQL expert, but I don't see how "u%pdate" is valid SQL. Why would the database interpret "u%pdate" as valid SQL? Is the application cleaning up the input before passing to the db?
IMHO, if your customers have vulnerable apps, then they need to fix them. A network based IDS simply isn't going to be the best at detecting every possible variation of injection (or anything else imo, but that's a whole different soap box). It just doesn't have the required context. Throw TLS into the mix, and most of the time coverage drops to zero.

SQL Injection Produces "Wrong Name" Errors

Hi all,
By now, you're familiar with the SQL Injection attacks
floatin' around out there, but what has me puzzled is how my
ColdFusion servers are responding to them. For each SQL Injection
attempt, CF throws an application error; this is from my
APPLICATION.LOG:
"Error","jrpp-953","09/19/08","13:27:04",,"Application (wrong
name: com/ms/asp/Application) The specific sequence of files
included or processed is: D:\MySite\web\product.cfm "
I've seen others complaining about this on ColdFusion MX 6,
ColdFusion MX 7 and ColdFusion 8, but every discussion terminates
mysteriously without a solution. It's an evil conspiracy....
Any help is greatly appreciated.

Hello,
Were you able to solve this problem and how?
Thanks

Future prospectus of APEX Developer

HI All,
Since 6 months i have been working as an APEX developer(SQL and PL/SQL)
and i'm planning to learn DBA
I'm bit confused to take my carrier with APEX development .
Could any one help me with this..
My questions are as shown below
1)What is the demand in the market comparatively DBA and other Developers.
2)how can i grow competitively in this field.
Kindly help me with this.
Based on your opinions i ll be taking the next step.
Edited by: Basva on Feb 16, 2011 6:03 AM
Edited by: Basva on Feb 16, 2011 6:19 AM
Edited by: Basva on Feb 17, 2011 6:07 AM

HI All,
Since 6 months i have been working as an APEX developer(SQL and PL/SQL)
and i'm planning to learn DBA
I'm bit confused to take my carrier with APEX development .
Could any one help me with this..
My questions are as shown below
1)What is the demand in the market comparatively DBA and other Developers.
2)how can i grow competitively in this field.
Kindly help me with this.
Based on your opinions i ll be taking the next step.
Edited by: Basva on Feb 16, 2011 6:03 AM
Edited by: Basva on Feb 16, 2011 6:19 AM
Edited by: Basva on Feb 17, 2011 6:07 AM

Is cfinsert and cfupdate open to SQL Injection

Hello All,
I'm looking for a real answer on if cfinsert and cfupdate are vulnerability to SQL Injection. The closest thing I can find from Adobe is Ben Forta's Personal recommendation. I was hoping to find some form of "official note" in the live docs to indicate there is a SQL Injection issue with cfinsert - cfupdate. (Other than someone's post to Ben's Blog)
http://www.forta.com/blog/index.cfm/2006/10/3/Use-CFINSERT-And-CFUPDATE
In this forum I have seen this question asked, and the only answer is "You should validate your inputs". Yes, you should, but that does not answer the question of if cfinsert and cfupdate is vulnerability to SQL Injection.
I have found this blog entry that if I interpret is correctly from his findings cfinsert and cfupdate where only vulnerability to SQL Injection IF you did not give cfinsert - cfupdate the list of fields to take action on. -Is this true?
http://blog.securityps.com/2009/05/demystifying-cfinsert-sql-injection.html
Also, on a closely related note, is cfinsert - cfupdate on ColdFusion 9 also vulnerable? If so, why? Seems like a BUG that could be easly addressed by the CF server team.
Thank you,

I do agree with you here. But to be devil's advocate for a second: the same could be said of <cfquery>. One has to take additional measures to ensure the same vulnerabilities are mitigated with that.
I'm not sure that it's really news that these two tags are not the most well-thought-out features in the CF arsenal, and if you listen to most opinions in the community regarding <cfinsert> and <cfupdate>, it's: "don't use them".
They're great for quick and dirty insert/update processes in internal or test code, but I'd never use them in production.
It also remains a fact that any external input (form fields, URL param) must be validated as being kosher and within expected margins before they're used in any way. That is just common sense. And if one neglects to do that: one brings any eventuality onto one's self. The problem here really is with people not doing their "due diligence" on externally sourced data, not specififcally with <cfinsert>, <cfupdate> or <cfquery>.
Still: I think Adobe should make it more clear in the docs that additional measures need to be take to make them safe. And by that time... one might as well use a <cfquery> to do the SQL.
Adam

Remote debugging with APEX and SQL Developer

Hi,
I have problems concerning breakpoints within my SQL Packages I want to debug.
I want to force SQL-Developer to suspend execution of a function, so I can get forward step by step.
The SQL-Developer do not stop executing at the breakpoints I set in the Package.
The message I get is the following (on SQL-Developer side):
Debugger accepted connection from remote process on port 4000.
Processing 110 classes that have already been prepared...
Finished processing prepared classes.
Debugger disconnected from remote process.
Seems to me, that the process runs into the debug-mode but leave without stopping at a given breakpoint??
Do anybody have an idea how to solve it?
We use Oracle 10.2.0.3.0, SQL Developer 1.5.1 and APEX 3.1.2.
The Package-function I want to debug runs on another Oracle database as the APEX application.
Thanks in advance
Regards
Norbert
Edited by: Norbert2 on Apr 20, 2009 5:47 AM

Hi Carsten,
now I have done a further step. I can debug a remote PL/SQL-Package through APEX, but now I get an exception when the program execution jumps back to the APEX PL/SQL-Package.
My APEX-Page-Process looks like this:
BEGIN
dbms_debug_jdwp.connect_tcp(host => 'IP-ADDRESS', port => '4201');
APEX_TEST_PKG.remoteDebug;
dbms_debug_jdwp.disconnect;
END;The procedure APEX_TEST_PKG.remoteDebug looks like this (located on the APEX-DB):
PROCEDURE startRemoteDebug
AS
    v_string    VARCHAR2(50)   := '';
BEGIN
    [email protected](host => 'IP-ADDRESS', port => '4000',
             option_flags => dbms_debug_jdwp.connect_defer_suspension);
    v_string := [email protected];
    DBMS_OUTPUT.PUT_LINE(v_string);
    [email protected];
END remoteDebug; The procedure REMOTE_TEST_PKG.testFunc looks like this (located on the Remote-DB):
FUNCTION testFunc RETURN VARCHAR2
AS
    v_string    VARCHAR2(50)   := '';
BEGIN
    v_string := 'Test';
RETURN v_string;
END testFunc; When I start the debug session without the option dbms_debug_jdwp.connect_defer_suspension, I get an exception Oracle.EXCEPTION_ORA_604.
Starting the debug session with the above mentioned option, I am able to debug the remote function.
But now I get an exception when the executor tries leaving the remote function going back to the invoking function. With the debugger I can step over the return-statment successfully and the debugger steps on the next line END testFunc;. On this line I get the exception above
Exception breakpoint occurred at line -1 of PBREAK.pls.
$Oracle.Builtin.EXCEPTION_USER:
Exception breakpoint occurred at line -1 of PBREAK.pls.
$Oracle.Builtin.EXCEPTION_USER: I tried another way where I get now exception and where I can step through my functions in APEX, descending to functions in the remote db and going back to APEX.
For this case I put the debug-statements in remote function:
FUNCTION testFunc RETURN VARCHAR2
AS
    v_string    VARCHAR2(50)   := '';
BEGIN
    dbms_debug_jdwp.connect_tcp(host => 'IP-ADDRESS', port => '4000');
    v_string := 'Test';
    dbms_debug_jdwp.disconnect;
RETURN v_string;
END testFunc; But I have no idea why it doesn't work properly starting the remote debug session in the apex procedure.
Regards
Michael
Edited by: user6044915 on 02.09.2009 04:08
Edited by: user6044915 on 02.09.2009 04:21
Edited by: user6044915 on 02.09.2009 04:28

SQL Report query with condition (multiple parameters) in apex item?

Hello all,
I have a little problem and can't find a solution.
I need to create reports based on a SQL query or I.R. Nothing hard there.
Then I need to add the WHERE clause dynamically with javascript from an Apex item.
Again not very hard. I defined an Apex item, set my query like this "SELECT * FROM MYTAB WHERE COL1 = :P1_SEARCH" and then I call the page setting the P1_SEARCH value. For instance COL1 is rowid. It works fine.
But here is my problem. Let's consider that P1_SEARCH will contain several rowids and that I don't know the number of those values,
(no I won't create a lot of items and build a query with so many OR!), I would like sotheming like "SELECT * FROM MYTAB WHERE ROWID IN (:P1_SEARCH) with something like : ROWID1,ROWID2 in P1_SEARCH.
I also tried : 'ROWID1,ROWID2' and 'ROWID1','ROWID2'
but I can't get anything else than filter error. It works with IN with one value but as soon as there are two values or more, it seems than Apex can't read the string.
How could I do that, please?
Thanks for your help.
Max

mnoscars wrote:
But here is my problem. Let's consider that P1_SEARCH will contain several rowids and that I don't know the number of those values,
(no I won't create a lot of items and build a query with so many OR!), I would like sotheming like "SELECT * FROM MYTAB WHERE ROWID IN (:P1_SEARCH) with something like : ROWID1,ROWID2 in P1_SEARCH.
I also tried : 'ROWID1,ROWID2' and 'ROWID1','ROWID2'
but I can't get anything else than filter error. It works with IN with one value but as soon as there are two values or more, it seems than Apex can't read the string.For a standard report, see +{message:id=9609120}+
For an IR—and improved security avoiding the risk of SQL Injection—use a <a href="http://download.oracle.com/docs/cd/E17556_01/doc/apirefs.40/e15519/apex_collection.htm#CACFAICJ">collection</a> containing the values in a column instead of a CSV list:
{code}
SELECT * FROM MYTAB WHERE ROWID IN (SELECT c001 FROM apex_collections WHERE collection_name = 'P1_SEARCH')
{code}
(Please close duplicate threads spawned by your original question.)

Help With "Package An Application" Using APEX 3.0.1 with XE

I'm using apex 3.0.1 and XE Database and I'm trying to create a package application but without succes, I can find the way to do it and I know that it's possible. What I'm trying to do is create a file like the package application that we can download from Oracle page but for an application I create.
Looking here in the forums I found this link:
http://www.oracle.com/technology/oramag/oracle/06-jul/o46browser.html
And I was trying to follow it step by step until I found the Step 4: Package Up the Application, number 7.
1. In the breadcrumb links in the upper left-hand corner of the screen, click the Application nnn link (where nnn corresponds to the ID of the employee lookup application in your Oracle Application Express instance).
2. Click the Edit Attributes icon, and then click Supporting Objects.
3. Click Edit.
4. In the Welcome section, enter readme text for the application in the Message field, such as "This application lets users browse employee information. Users accessing the application with a USERID stored in the table can upload a photo if one does not already exist."
5. Click the right arrow to go to the Prerequisites tab.
6. To ensure that folks who already have a table named OM_EMPLOYEES in their schemas don't run into a conflict with this script, enter OM_EMPLOYEES in the first Object Names field and click Add.
[b]7. Click the Scripts tab.
8. Click Create.
9. Click the Copy from SQL Script Repository icon.
10. Enter Create Table, Sequence, and Trigger in the Name field, and click Next.
11. Select om_employees.sql, and click Create Script.
12. Repeat steps 9 through 11 for the om_download_pict.sql and seed_data .sql scripts. Feel free to name these scripts as you see fit.
13. Click the Deinstall tab, and click Create.
14. Click the Create from File icon.
15. Click Browse, select the drop_om_objects.sql script (included with this column's download file), click Open, and click Create Script.
16. Click the right arrow.
17. Select Yes for Include Supporting Object Definitions in Export.
18. Click Apply Changes.
I can't find the scrips tab and I completely lost. I start to believe that this steps don't apply for Apex 3.0.1.
If anyone of you could help me with this, please do it, I really need it.
Johann.

Johann,
That doc was probably written against 2.2 because in 3.0, we reworked the supporting objects page a bit. If you are on Supporting Objects, in the Installation region, click on Installation Scripts. For more information, check the Advanced Tutorials document off our OTN site for a Tutorial called Reviewing a Packaged App (something like that - I can't access the doc at the moment).
-- Sharon

Apex mixes applications working with two windows at the same time

Hi all, while developing in Apex I have found the following problem:
Working with two different applications at the same time, the browser goes from one to another indistinctly.
To reproduce the problem:
1. Open the same application builder in two different Firefox windows
2. Open a different application in each window (In my case: application 103 in window1 and application 105 in window2)
3. Go to shared components in both windows (window1 first)
- window1 breadcrumbs show: Home > Application Builder > Application 103 > Shared Components
- window2 breadcrumbs show: Home > Application Builder > Application 105 > Shared Components
4. Click in any shared component in window1 (Templates, Authentication Schemes...)
- window1 breadcrumbs show: Home > Application Builder > Application *105* > Shared Components > Templates (Application 105 instead of 103)
Is it a bug? I have read the known issues [[Here]|http://www.oracle.com/technetwork/developer-tools/apex/downloads/apex402knownissues-189793.html] but it does not appear.
Related Data:
Application Express version 4.0.2.00.07
Firefox 3.6.15
SO: Windows XP
The error is not reproduced with IE7. I have not tested any other browser.
Regards,
Molina

If you tried opening up two pages in the same application each of which modifies the same page items, you would notice the same issue.
This is because, in a session there is only one set of values for page items(or application items) and every parallel call to the same page would update the same bind variables.
Now the development environment or Apex Builder is also an apex application , and when try and open up the pages as you mentioned, they both access the same Application Builder page and sets/resets any existing values for those variables(and maybe cookies too if they are being used) , hence the 'mixing up'.
If that didn't convince you, check the URL of both the pages when you load them, they should show the same page number ( f?p=APP_ID:PAGE_NUMBER syntax). Imagine if the same approach was done with one of your application pages, say an edit form opened from a report with multiple records in multiple tabs like what happened with this case: {message:id=9346663}
So this really isn't a bug in a way, because that is how session states in apex is/was maintained. Ofcourse if they used another kind of development platform for building pages, it may have been avoided, but thats an altogether different point in itself.

Use dataguard with applications built with APEX

Hi all,
I have questions about APEX with Dataguard. Can I develop an application with APEX and then use Dataguard? Can the application switch to Standby Database automatically when there is a failover event?
If it is possible, Can you explain me?
Thank in advance
Vincenzo

APEX should work fine in a Physical Standby as it's an exact copy of your database. Logical Standby should work too, but you need to make sure the FLOWS_ schemas are being replicated and there is no transformation done to them. Also not sure if there are any datatypes in APEX that would not work in a Logical Standby, but you should be able to look those up in the Data Guard Docs then query all_tab_columns where table_owner like 'FLOWS_%' to verify. Physical Standby would be a safer bet.
You want to make sure you install your HTTP server on a different server so it doesn't go down with your database in the event the OS shuts down. Then in the TNS entry for your database you can add [url ="http://download.oracle.com/docs/cd/B19306_01/network.102/b14213/tnsnames.htm#sthref676"]failover=on and the additional IP address(es). This will automatically failover when your primary database is no longer accessible. Personally I would have a second HTTP Server installed at your backup site and handle the failover at the network level. If a sprinkler head pops or your air conditioner fails at your primary site, everything is going to stop there. You can easily have 2 HTTP servers accessing the same APEX install (on one database) at the same time, so it's easy to test / verify the state of the 2nd http server. You'll probably want to mirror the /i/ directory and any image directories you have for your applications from your primary site to your failover.
"Automatically"? Yes, all of this can be configured to happen automatically, but most people (Tom Kyte included) recommend that you only failover manually as it's best to investigate the underlying issues with your primary site before failing over. You should be able to tell within the first 5 minutes whether the problem was a simple network outage or unintentional OS reboot, or a more serious problem such as a corrupt block, Air Conditioning failure, hardware issues, etc. Keep in mind to do automatic failover you need a 3rd site as an observer of your 2 sites to decide which site is "still alive".
Varad, I believe TAF is only a RAC concept, not Data Guard. Furthermore, I'm pretty sure that TAF is not built into APEX. So, in an APEX / RAC installation, if you're running a page that takes say 4 seconds (long running report) and 2 seconds in the database node on which you are running fails, the end user is likely going to see a "404 not found" or some other error, then when they refresh the page it will hit another RAC note and return the results. I'm pretty sure the TAF logic is not built into APEX or mod_plsql to migrate the database session to a new surviving node when it detects a failure. Again, I could be wrong, but I'm pretty sure I'm not in this particular case (someone please prove me wrong).
Thanks,
Tyler

Having installed an upgrade for Photoshop Elements 13, I cannot open the application. I get an error message saying "Adobe Photoshop Elements Editor cannot be opened because of a problem. Check with the developer to make sure Adobe Photoshop Elements Edit

Having installed an upgrade for Photoshop Elements 13, I cannot open the application. I get an error message saying "Adobe Photoshop Elements Editor cannot be opened because of a problem. Check with the developer to make sure Adobe Photoshop Elements Editor works with this version of OS X. You may need to reinstall the application. Be sure to install any available updates for the application and OS X".
I have since uninstalled and reinstalled the app, but get the same error message.

Which version of OS X do you have? It's not clear from your post whether "installed an upgrade" means you just installed PSE 13 as an upgrade or you installed an update to PSE 13, like ACR 9 or 13.1. Please clarify.

SQL Injection, replace single quote with two single quotes?

Is replacing a single quote with two single quotes adequate
for eliminating
SQL injection attacks? This article (
http://www.devguru.com/features/kb/kb100206.asp
) offers that advice, and it
enabled me to allow users to search name fields in the
database that contain
single quotes.
I was advised to use "Paramaterized SQL" in an earlier post,
but I can't
understand the concept behind that method, and whether it
applies to
queries, writes, or both.

Then you can use both stored procedures and prepared
statements.
Both provide better protection than simply replacing
apostrophes.
Prepared statements are simple:
Set myCommand = Server.CreateObject("ADODB.Command")
...snip...
myCommand.CommandText = "INSERT INTO Users([Name], [Email])
VALUES (?, ?)"
...snip...
myCommand.Parameters.Append
myCommand.CreateParameter("@Name",200,1,50,Name)
myCommand.Parameters.Append
myCommand.CreateParameter("@Email",200,1,50,Email)
myCommand.Execute ,,128 'the ,,128 sets execution flags that
tell ADO not to
look for rows to be returned. This saves the expense of
creating a
recordset object you don't need.
Stored procedures are executed in a similar manner. DW can
help you with a
stored procedure through the "Command (Stored Procedure)"
server behavior.
You can see a full example of a prepared statement by looking
at DW's
recordset code after you've created a recordset using version
8.02.
"Mike Z" <[email protected]> wrote in message
news:eo5idq$3qr$[email protected]..
>I should have repeated this, I am using VBScript in ASP,
with an Access DB.
>

When trying to open Pages 4.0.1 I get a message stating "Pages cannot be opened because of a problem, check with the developer to make sure Pages works with this version of Mac OS X. You may need to reinstall the application." Using OS X 10.6.8

When trying to open Pages 4.0.1 I get a message stating "Pages cannot be opened because of a problem, check with the developer to make sure Pages works with this version of Mac OS X. You may need to reinstall the application. Be sure to install any available updates for the application and Mac OS X."
I've run the software update several times. Pages is located in my iWork '09 folder in Applications. Using OS X 10.6.8

Delete and reinstall it.
(104030)

SQL Injection threat with APEX developed applications

Similar Messages

Maybe you are looking for