论文标题
您不得通过：减轻对传统Web应用程序的SQL注入攻击
You shall not pass: Mitigating SQL Injection Attacks on Legacy Web Applications
论文作者
论文摘要
SQL注入（SQLI）攻击对Web应用程序的安全构成了重大威胁。现有方法不支持面向对象的编程，该编程使这些方法无法保护现实世界中的Web应用程序（例如WordPress，Joomla或Drupal），以防止SQLI攻击。我们为PHP Web应用程序提出了一种新型的混合静态分析，该分析限制了访问数据库的每个PHP功能。我们的工具SQLBlock将Web应用程序中脆弱的PHP功能的攻击表面降低为一组查询描述符，以证明PHP功能的良性功能。我们将SQLBlock作为MySQL和PHP的插件实现。我们的方法不需要对Web应用程序进行任何修改。 W在WordPress，Joomla，Drupal，Magento及其插件中评估11个SQLI漏洞的SQLBlock。我们证明，SQLBlock成功地阻止了所有11个SQLI利用，并且具有可忽略的性能开销（即，在负载重量的Web服务器上最多3％）
SQL injection (SQLi) attacks pose a significant threat to the security of web applications. Existing approaches do not support object-oriented programming that renders these approaches unable to protect the real-world web apps such as Wordpress, Joomla, or Drupal against SQLi attacks. We propose a novel hybrid static-dynamic analysis for PHP web applications that limits each PHP function for accessing the database. Our tool, SQLBlock, reduces the attack surface of the vulnerable PHP functions in a web application to a set of query descriptors that demonstrate the benign functionality of the PHP function. We implement SQLBlock as a plugin for MySQL and PHP. Our approach does not require any modification to the web app. W evaluate SQLBlock on 11 SQLi vulnerabilities in Wordpress, Joomla, Drupal, Magento, and their plugins. We demonstrate that SQLBlock successfully prevents all 11 SQLi exploits with negligible performance overhead (i.e., a maximum of 3% on a heavily-loaded web server)
