Are the ASP.net __EVENTTARGET and __EVENTARGUMENT susceptible to SQL injection?

A security review was done against one of our ASP.net applications and returned in the test results was a SQL Injection Exposures considered to be a high risk item.

The test that was performed passed a SQL statement as the value of the __EVENTTARGET and the __EVENTARGUMENT. I am wondering since these 2 values are ASP.net auto-generated hidden fields used for the Auto-Postback feature of the framework and hold information specific to the controls initiating the postback, is there really the potential for SQL injection if you are never manually calling and or pulling values out of these parameters in your code behind?

Answers


..if you are never manually calling and or pulling values out of these parameters in your code behind...

Assuming the above statement to be true, I don't see those parameters being susceptible to SQL Injection. Perhaps you ran an automated scan and this is a false alarm?


You should always assume that dirty data can be passed from your form. Allowing it to be loaded from a postback, the __EVENTARGUMENT can be altered from the client side via javascript.

Always use good practices to make sure you don't allow sql-injection; and used parametrized SQL statements or another safe method.

http://msdn.microsoft.com/en-us/library/ms998271.aspx


Need Your Help

Why does RKNSJSONSerialization crash on iOS 6?

ios objective-c restkit

I'm seeing a crash in RKNSJSONSerialization on iOS 6 only - not on iOS 7. I'm using RestKit 0.20.3 and it happens fairly consistently for me. Even when I make the same request and get the same resp...

SFML display window behind all others

java windows desktop sfml

I am using the Java binding for SFML. I want to display a RenderWindow behind all others - so that its straight above my desktop wallpaper but behind all the other windows that are open. It doesn't...