IBM Appscan has detected that some pages in our system are vulnerable to SQL Injection.

The report shows which URLs are vulnerable, so I checked the pages based on the URLs, but most of the pages reported used CAML query to retrieve/add new/update data from list, so no straight SQL query to Database.

I do some research about SQL Injection in CAML query, and found this Link

The question is, is CAML query vulnerable to SQL Injection? If no, is there any proof documentation or something? If yes, then how do we prevent it?

Thank you.

  • Not really related, just curious, are you really using <Batch> to add new/update list data? – eirikb Feb 17 '14 at 6:49
  • Hi eirikb, to delete item from list I'm using <Batch>, but for add new/update item I'm using SPList AddItem() and SPListItem Update() – kamal Feb 19 '14 at 1:36
  • Ok, I probably just misunderstood, since that is the only way I know how to add new/update using CAML. – eirikb Feb 19 '14 at 12:01

CAML queries are NOT vulnerable to SQL injection.

I don't think you'll find any direct reference or proof. Consider that the conversion from CAML to SQL all happens between the data layer and the SharePoint API. You can't control how SharePoint generates the SQL for a given CAML statement and therefore you don't have to worry about SQL injection. That's handled by SharePoint.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.