Signature Detail

HTTP: SQL AUTHID Keyword SQL Injection

This signature detects attempts to run SQL queries with high privileges. The AUTHID CURRENT_USER keyword can be used to run queries with privileges of the owner. It can also be a false positive. To reduce False Positives, it is strongly recommended that these signatures only be used to inspect traffic from the Internet to your organization's web servers that use SQL backend databases to generate content and not to inspect traffic going from your organization to the Internet.

Extended Description

Injection of the AUTHID CURRENT_USER SQL directive by an attacker may escalate privilege levels and allow an attacker access to database objects that would otherwise be inaccessible under the definer rights model.

References

• URL: http://security-papers.globint.com.ar/oracle_security/sql_injection_in_oracle.php