What is ColdFusion SQL injection?
SQL injection, like ColdFusion Cross-Site Scripting, is a type of digital attack where a potential intruder will look for weaknesses in application and database systems that can be exploited to gain access to user information such as usernames and passwords. ColdFusion SQL injection is an SQL injection attack aimed at ColdFusion installations.
There are several types of ColdFusion SQL injection attacks. The most common form of attack is referred to as a classic SQL injection attack. This kind of attack is performed when a web interface does not properly filter out special characters such as semicolons. In this attack, the intruder will go to a web form field such as the log in field, and type in their username followed by a special character and an SQL command. Since many web forms are run on the database with administrator permissions this will allow the attacker to execute arbitrary code to gain access to the database.
Experienced ColdFusion programmers will know how to prevent these ColdFusion SQL injection attacks. Simple changes such as only granting the web server SQL user the permissions it needs are a start, but the defenses against this kind of attack need to be as varied as the methods of performing a ColdFusion SQL injection attack.
Because of this and other concerns, it is recommended that only expert ColdFusion programmers be allowed to develop secure web applications that are going to be facing the public.
Expert ColdFusion programmers will be familiar with parameterized statements, escaping special characters, and other defensive measures to prevent these sorts of attacks, while inexperienced developers will not take these precautionary steps and this could result in a public relations nightmare as thousands or millions of customer database entries are compromised.
The importance of proper SQL hardening cannot be overstated. There have been several cases in recent memory of multinational mega-corporations not hiring experienced SQL programmers and having customer credit card numbers and social security numbers stolen. Not only did these customers have to be alerted to the intrusion, causing a massive loss of confidence in the company. These incidents frequently cost companies millions of dollars.
So in summary it is of the utmost importance not only for the integrity of your data but also legally, as companies do frequently face legal penalties for not maintaining proper database security, to ensure that when you are developing any application that you only have expert ColdFusion programmers to do the work.