6

IBM Appscan has detected that some pages in our system are vulnerable to SQL Injection.

The report shows which URLs are vulnerable, so I checked the pages based on the URLs, but most of the pages reported used CAML query to retrieve/add new/update data from list, so no straight SQL query to Database.

I do some research about SQL Injection in CAML query, and found this Link

The question is, is CAML query vulnerable to SQL Injection? If no, is there any proof documentation or something? If yes, then how do we prevent it?

Thank you.

Improve this question
3
  • Not really related, just curious, are you really using <Batch> to add new/update list data?
    – eirikb
    Commented Feb 17, 2014 at 6:49
  • Hi eirikb, to delete item from list I'm using <Batch>, but for add new/update item I'm using SPList AddItem() and SPListItem Update()
    – kamal
    Commented Feb 19, 2014 at 1:36
  • Ok, I probably just misunderstood, since that is the only way I know how to add new/update using CAML.
    – eirikb
    Commented Feb 19, 2014 at 12:01

1 Answer 1

Reset to default
9

CAML queries are NOT vulnerable to SQL injection.

I don't think you'll find any direct reference or proof. Consider that the conversion from CAML to SQL all happens between the data layer and the SharePoint API. You can't control how SharePoint generates the SQL for a given CAML statement and therefore you don't have to worry about SQL injection. That's handled by SharePoint.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.