Formal Analysis of Vulnerabilities of Web Applications Based on SQL Injection (Extended Version)

2016/05/02 by Federico De Meo, De Meo, Federico, Marco Rocchetto +3
Computer Science · #Cloud Data Security Solutions #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Security and Verification in Computing #Web Application Security Vulnerabilities

paper · pdf · doi:10.48550/arxiv.1605.00358

openalex publication_date 2016/05/02 · openalex created_date 2016/06/24 · openalex updated_date 2026/07/28

Abstract

We present a formal approach that exploits attacks related to SQL Injection (SQLi) searching for security flaws in a web application. We give a formal representation of web applications and databases, and show that our formalization effectively exploits SQLi attacks. We implemented our approach in a prototype tool called SQLfast and we show its efficiency on real-world case studies, including the discovery of an attack on Joomla! that no other tool can find.

Related

• Sound and precise analysis of web applications for injection vulnerabilities
• A Detailed Survey on Various Aspects of SQL Injection in Web Applications: Vulnerabilities, Innovative Attacks, and Remedies
• Analysis of SQL Injection Detection Techniques
• Framework of SQL Injection Attack
• Detecting and Mitigating SQL Injection Vulnerabilities in Web Applications