Formal Analysis of Vulnerabilities of Web Applications Based on SQL Injection (Extended Version)

TL;DR

This paper introduces a formal method and a prototype tool, SQLfast, to identify SQL Injection vulnerabilities in web applications, demonstrating effectiveness on real-world cases including previously undetected attacks.

Contribution

It provides a formal framework for analyzing SQLi vulnerabilities and a novel tool that outperforms existing solutions in detecting security flaws.

Findings

Successfully identified new SQLi attack on Joomla!

Demonstrated efficiency of SQLfast on real-world applications

Formalization effectively exploits SQLi vulnerabilities

Abstract

We present a formal approach that exploits attacks related to SQL Injection (SQLi) searching for security flaws in a web application. We give a formal representation of web applications and databases, and show that our formalization effectively exploits SQLi attacks. We implemented our approach in a prototype tool called SQLfast and we show its efficiency on real-world case studies, including the discovery of an attack on Joomla! that no other tool can find.