A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
Source abstract
Abstract
Static analysis is popular for detecting SQL injection vulnerabilities. However, due to the lack of accurate modeling of object-oriented database extensions, current methods fail to accurately detect SQL injection vulnerabilities in applications that use object-oriented database extensions. We propose a program transformation-based SQL injection vulnerability detection method to address this issue. This method consists of two stages: program transformation and vulnerability detection. In the first stage, object-oriented database extensions are automatically transformed into semantically equivalent procedural database extensions through the identification of key statements, call relation verification, and program transformation. In the second stage, application programs are automatically scanned using a combination of control flow graph construction and taint analysis techniques to detect SQL injection vulnerabilities. Based on the proposed method, we have implemented the OODBE-SCAN prototype system and performed experimental analysis on eight modern PHP applications. We compare OODBE-SCAN with two related static analysis tools, RIPS and Seay. The results show that OODBE-SCAN can detect more real-world vulnerabilities and has higher accuracy than existing methods.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Web Application Security Vulnerabilities · Security and Verification in Computing · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei 230037, China
References (40)
Show source-provided references
1. (2023, September 12). CNVD. Available online: https://www.cnvd.org.cn/.
2. Analysis and Implementation of SQL Injection Vulnerability Mining Technology Based on Machine Learning
3. Dahse, J., and Holz, T. (2014, January 23). Simulation of Built-in PHP Features for Precise Static Code Analysis. Proceedings of the NDSS, San Diego, CA, USA.10.14722/ndss.2014.23262 ↗
4. Jovanovic, N., Kruegel, C., and Kirda, E. (2006, January 21–24). Pixy: A static analysis tool for detecting web application vulnerabilities. Proceedings of the 2006 IEEE Symposium on Security and Privacy (S&P’06), Oakland, CA, USA.10.1109/SP.2006.29 ↗
5. Nunes, P.J.C., Fonseca, J., and Vieira, M. (2015, January 22–25). phpSAFE: A security analysis tool for OOP web application plugins. Proceedings of the 2015 45th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, Ashington, DC, USA.10.1109/DSN.2015.16 ↗
6. Nashaat, M., Ali, K., and Miller, J. (2017, January 17–18). Detecting Security Vulnerabilities in Object-Oriented PHP Programs. Proceedings of the 2017 IEEE 17th International Working Conference on Source Code Analysis and Manipulation (SCAM), Shanghai, China.10.1109/SCAM.2017.20 ↗
7. Jahanshahi, R., Doupé, A., and Egele, M. (2020, January 5–9). You shall not pass: Mitigating sql injection attacks on legacy web applications. Proceedings of the 15th ACM Asia Conference on Computer and Communications Security, Taipei, Taiwan.10.1145/3320269.3384760 ↗
8. Luo, C., Li, P., and Meng, W. (2022, January 7–11). TChecker: Precise Static Inter-Procedural Analysis for Detecting Taint-Style Vulnerabilities in PHP Applications. Proceedings of the Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, Los Angeles, CA, USA.10.1145/3548606.3559391 ↗
9. Yan, X.X., and Ma, H.T. (2017, January 14–16). A New Static Vulnerabilities Analysis Algorithm for PHP Codes. Proceedings of the 2017 International Conference on Network and Information Systems for Computers (ICNISC), Shanghai, China.10.1109/ICNISC.2017.00034 ↗
10. Son, S., and Shmatikov, V. (2011, January 5). SAFERPHP: Finding semantic vulnerabilities in PHP applications. Proceedings of the ACM SIGPLAN 6th Workshop on Programming Languages and Analysis for Security, San Jose, CA, USA.10.1145/2166956.2166964 ↗
11. Dahse, J. (2016). Static Detection of Complex Vulnerabilities in Modern PHP Applications. [Ph.D. Thesis, Ruhr-Universität Bochum].
12. Alhuzali, A., Gjomemo, R., Eshete, B., and Venkatakrishnan, V. (2018, January 15–17). {NAVEX}: Precise and scalable exploit generation for dynamic web applications. Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), Baltimore, MD, USA.
13. Dahse, J., Krein, N., and Holz, T. (2014, January 3–7). Code reuse attacks in php: Automated pop chain generation. Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Scottsdale, AZ, USA.10.1145/2660267.2660363 ↗
14. Backes, M., Rieck, K., Skoruppa, M., Stock, B., and Yamaguchi, F. (2017, January 26–28). Efficient and flexible discovery of php application vulnerabilities. Proceedings of the 2017 IEEE european symposium on security and privacy (EuroS&P), Paris, France.10.1109/EuroSP.2017.14 ↗
15. (2023, September 10). Cnseay. Available online: https://github.com/f1tz/cnseay/.
16. Li, P., and Meng, W. (2021, January 19–23). Lchecker: Detecting loose comparison bugs in php. Proceedings of the Web Conference 2021, Virtual.10.1145/3442381.3449826 ↗
17. Clarke, J. (2014). SQL Injection Attacks and Defense, Tsinghua University Press. [2nd ed.].
18. A lattice model of secure information flow10.1145/360051.360056 ↗
19. Certification of programs for secure information flow10.1145/359636.359712 ↗
20. Shankar, U., Talwar, K., Foster, J.S., and Wagner, D. (2001, January 13–17). Detecting format string vulnerabilities with type qualifiers. Proceedings of the 10th USENIX Security Symposium (USENIX Security 01), Washington, DC, USA.
21. Foster, J.S., Terauchi, T., and Aiken, A. (2002, January 17–19). Flow-sensitive type qualifiers. Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation, Berlin, Germany.10.1145/512529.512531 ↗
22. Lam, M.S., Martin, M., Livshits, B., and Whaley, J. (2008, January 7–8). Securing web applications with static and dynamic information flow tracking. Proceedings of the 2008 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation, San Francisco, CA, USA.10.1145/1328408.1328410 ↗
23. (2023, September 10). Taint Analysis. Available online: https://wiki.sei.cmu.edu/confluence/display/c/Taint+Analysis.
24. Xu, W., Bhatkar, S., and Sekar, R. (August, January 31). Taint-enhanced policy enforcement: A practical approach to defeat a wide range of attacks. Proceedings of the USENIX Security Symposium, Vancouver, BC, Canada.
25. Aho, A.V. (2003). Compilers: Principles, Techniques and Tools (for Anna University), 2/e, Pearson Education.
26. Davis, B., and Chen, H. (2010, January 23–24). {DBTaint}:{Cross-Application} information flow tracking via databases. Proceedings of the USENIX Conference on Web Application Development (WebApps 10), Boston, MA, USA.
27. Bravenboer, M., and Smaragdakis, Y. (2009, January 25–29). Strictly declarative specification of sophisticated points-to analyses. Proceedings of the 24th ACM SIGPLAN Conference on Object Oriented Programming Systems Languages and Applications, Orlando, FL, USA.10.1145/1640089.1640108 ↗
28. Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones10.1145/2619091 ↗
29. Detecting and removing web application vulnerabilities with static analysis and data mining10.1109/TR.2015.2457411 ↗
30. Zhao, J., Lu, Y., Zhu, K., Chen, Z., and Huang, H. (2022). Cefuzz: An directed fuzzing framework for php rce vulnerability. Electronics, 11.10.3390/electronics11050758 ↗
31. Wang, M., Jung, C., Ahad, A., and Kwon, Y. (2021, January 15–19). Spinner: Automated Dynamic Command Subsystem Perturbation. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event Republic of Korea.10.1145/3460120.3484577 ↗
32. Shi, C.c., Zhang, T., Yu, Y., and Lin, W. (2012, January 12–13). A new approach for SQL-injection detection. Proceedings of the Instrumentation, Measurement, Circuits and Systems, Hong Kong, China.10.1007/978-3-642-27334-6_28 ↗
33. Zhang, K. (2019, January 11–15). A machine learning based approach to identify SQL injection vulnerabilities. Proceedings of the 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE), San Diego, CA, USA.10.1109/ASE.2019.00164 ↗
34. Boyd, S.W., and Keromytis, A.D. (2004, January 8–11). SQLrand: Preventing SQL injection attacks. Proceedings of the Applied Cryptography and Network Security: Second International Conference, ACNS 2004, Yellow Mountain, China.10.1007/978-3-540-24852-1_21 ↗
35. Huang, Y.W., Huang, S.K., Lin, T.P., and Tsai, C.H. (2003, January 20–24). Web application security assessment by fault injection and behavior monitoring. Proceedings of the 12th International Conference on World Wide Web, Budapest, Hungary.10.1145/775152.775174 ↗
36. Trickel, E., Pagani, F., Zhu, C., Dresel, L., Vigna, G., Kruegel, C., Wang, R., Bao, T., Shoshitaishvili, Y., and Doupé, A. (2023, January 21–25). Toss a fault to your witcher: Applying grey-box coverage-guided mutational fuzzing to detect sql and command injection vulnerabilities. Proceedings of the 2023 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP46215.2023.10179317 ↗
37. van Rooij, O., Charalambous, M.A., Kaizer, D., Papaevripides, M., and Athanasopoulos, E. (2021, January 4–8). webfuzz: Grey-box fuzzing for web applications. Proceedings of the Computer Security–ESORICS 2021: 26th European Symposium on Research in Computer Security, Darmstadt, Germany.10.1007/978-3-030-88418-5_8 ↗
38. Wang, J., Phan, R.C.W., Whitley, J.N., and Parish, D.J. (2010, January 16–18). Augmented attack tree modeling of SQL injection attacks. Proceedings of the 2010 2nd IEEE International Conference on Information Management and Engineering, Chengdu, China.10.1109/ICIME.2010.5478321 ↗
39. Wei, T. (2012). Model-Driven Penetration Test of the SQL Injection in Web Applications. [Ph.D. Thesis, Nankai University].
40. Chen, X.-L. (2013). The Research and Realization of SQL Vulnerability Detection System for Web Application. [Master’s Thesis, Southwest Jiaotong University].