HTTP: SQL 'exec master' Command Injection in URL

This signature detects attempts to perform an SQL injection attack against a web server. Some web applications may be vulnerable. A successful attack could result in a complete data compromise of the targeted website. However, it can be a false positive. To reduce false positives, it is strongly recommended that these signatures only be used to inspect traffic from the Internet to your organization's Web servers that use SQL backend databases to generate content and not to inspect traffic going from your organization to the Internet.

References

URL: http://msdn.microsoft.com/en-us/library/aa260689(v=sql.80).aspx http://www.owasp.org/index.php/SQL_Injection

Short Name

HTTP:SQL:INJ:EXEC-MASTER

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: SQL 'exec master' Command Injection in URL

References

Found a potential security threat?