Recently someone hacked into our database using sp_MSforeachtable
, so multiline query if im right.
Now my question is how i can modify sys.sp_MSforeachtable
, he is using @command1
and other commands to execute a query in order to drop our tables.
XXXX=Censored db name
(Somehow also spaces in front of the USE)
USE XXXX;
EXEC sp_msforeachtable "ALTER TABLE ? NOCHECK CONSTRAINT all";
EXEC sp_MSforeachtable @command1 = "DROP TABLE ?"
Then my SQL Profiler shows:
select @mscat = ltrim(str(convert(int, 0x0002)))
exec(N'declare hCForEachTable cursor global for select ''['' + REPLACE(schema_name(syso.schema_id), N'']'', N'']]'') + '']'' + ''.'' + ''['' + REPLACE(object_name(o.id), N'']'', N'']]'') + '']'' from dbo.sysobjects o join sys.all_objects syso on o.id = syso.object_id '
+ N' where OBJECTPROPERTY(o.id, N''IsUserTable'') = 1 ' + N' and o.category & ' + @mscat + N' = 0 '
+ @whereand)
declare hCForEachTable cursor global for select '[' + REPLACE(schema_name(syso.schema_id), N']', N']]') + ']' + '.' + '[' + REPLACE(object_name(o.id), N']', N']]') + ']' from dbo.sysobjects o join sys.all_objects syso on o.id = syso.object_id where OBJECTPROPERTY(o.id, N'IsUserTable') = 1 and o.category & 2 = 0
exec @retval = sys.sp_MSforeach_worker @command1, @replacechar, @command2, @command3, 0
create table #qtemp ( /* Temp command storage */
qnum int NOT NULL,
qchar nvarchar(2000) COLLATE database_default NULL
)
Could anyone let me know how to secure these things? SQL Profiler is showing me the application name is PHP5, so probably register page or login panel injection..