ASP.net website is not working properly while configuring in Internet Information Services

Question

I have created small webpage in ASP.net using c# in front end and oracle 11g at back end. Webpage is running successfully on my local pc as well as in windows server 2008 r/2 in visual studio 2010. So, i have configured same wabpage in IIS in server 2008 r/2 when i tried to "Browse" same page through IIS page is running but page has 3 buttons when i click on any button showing error. Server and my pc both are in same network.Thus, from my pc when i browse same webpage, it is running but when i click to button getting same error as in IIS

to sum up, simple static page is running successfully in IIS and local pc, but dynamic page means if any event (button click) consist database connection gives an error.

Additional Information - Windows server 2008 r/2 - 64 bit Webpage build on .NET Framework 4 VS 2010 - Configuration Properties - Debug - Any PC - build checked

My Code :-

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.OracleClient;
using System.Data;

public partial class Delivery_Delete : System.Web.UI.Page
{
DataSet ds = new DataSet();
OracleConnection con = new OracleConnection("Data Source=10.31.41.103/ORCL;User ID=RL_PET;Password=RL_PET;Unicode=True");

protected void Page_Load(object sender, EventArgs e)
{

}

protected void Button1_Click1(object sender, EventArgs e)
{
    con.Open();
    OracleDataAdapter a = new OracleDataAdapter("SELECT TO_NO, MERGE, TRUCK_NO, CUST_NM, QTY, PLANT_CD, DATA_STS, ORD_STS, MPNSEQ_NO, DEL_NO FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "' OR TRUCK_NO = '" + TextBox1.Text + "'", con);
    a.Fill(ds);
    if (String.IsNullOrEmpty(TextBox1.Text))
    {
        string display = "Please enter report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else if (ds.Tables[0].Rows.Count == 0)
    {
        string display = "Please check report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else
    {
        GridView1.DataSource = ds;
        GridView1.DataBind();
        GridView1.Visible = true;
        con.Close();
    }
}

protected void Button2_Click(object sender, EventArgs e)
{
    con.Open();
    OracleDataAdapter a = new OracleDataAdapter("SELECT TO_NO, MERGE, TRUCK_NO, CUST_NM, QTY, PLANT_CD, DATA_STS, ORD_STS, MPNSEQ_NO, DEL_NO FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "' OR TRUCK_NO = '" + TextBox1.Text + "' ", con);
    a.Fill(ds);
    if (String.IsNullOrEmpty(TextBox1.Text))
    {
        string display = "Please enter report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else if (ds.Tables[0].Rows.Count == 0)
    {
        string display = "Please check report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else
    {
        OracleConnection con1 = new OracleConnection("Data Source=10.31.41.103/ORCL;User ID=RL_PET;Password=RL_PET;Unicode=True");
        con1.Open();
        OracleDataAdapter a1 = new OracleDataAdapter("SELECT DATA_STS FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "' AND DATA_STS = 0", con1);
        if (ds.Tables[0].Rows[0].ItemArray[0] == "0")
        {
            OracleCommand cmd = con1.CreateCommand();
            cmd.CommandType = CommandType.Text;
            cmd.CommandText = "UPDATE WI_TO SET ORD_STS = 'D' WHERE TO_NO = '" + TextBox1.Text + "' ";
            cmd.ExecuteNonQuery();
            string display = "Delivery has been removed from ASRS...!!!";
            ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
        }
        else
        {
            string display = "Please cancel MPN first...!!!";
            ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
            con.Close();
        }
    }

}
protected void Button3_Click(object sender, EventArgs e)
{
    OracleDataAdapter a = new OracleDataAdapter("SELECT ORD_STS FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "'  OR TRUCK_NO = '" + TextBox1.Text + "'", con);
    a.Fill(ds);
    if (String.IsNullOrEmpty(TextBox1.Text))
    {
        string display = "Please enter report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else if (ds.Tables[0].Rows.Count == 0)
    {
        string display = "Please check report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else if (ds.Tables[0].Rows[0].ItemArray[0].ToString() == "D")
    {
        con.Open();
        OracleCommand cmd = con.CreateCommand();
        cmd.CommandType = CommandType.Text;
        cmd.CommandText = "UPDATE WI_TO SET ORD_STS = 'C' WHERE TO_NO = '" + TextBox1.Text + "' ";
        cmd.ExecuteNonQuery();
        string display = "Delivery has been successfully inserted in ASRS...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
        con.Close();
    }
    else
    {
        string display = "Delivery in ASRS...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
}

}

Error :- An attempt was made to load a program with an incorrect format. (Exception from HRESULT: 0x8007000B)

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.BadImageFormatException: An attempt was made to load a program with an incorrect format. (Exception from HRESULT: 0x8007000B)

Source Error:

Line 22: DataSet ds = new DataSet(); Line 23: OracleConnection con = new OracleConnection("Data Source=10.31.41.103/ORCL;User ID=RL_PET;Password=RL_PET;Unicode=True"); Line 24: con.Open(); Line 25: OracleDataAdapter a = new OracleDataAdapter("SELECT TO_NO, MERGE, TRUCK_NO, CUST_NM, QTY, PLANT_CD, DATA_STS, ORD_STS, MPNSEQ_NO, DEL_NO FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "' OR TRUCK_NO = '" + TextBox1.Text + "'", con); Line 26: a.Fill(ds);

Source File: e:\Portal_Final\Delivery Delete.aspx.cs Line: 24

Stack Trace:

[BadImageFormatException: An attempt was made to load a program with an
incorrect format. (Exception from HRESULT: 0x8007000B)] System.Data.Common.UnsafeNativeMethods.OCILobCopy2(IntPtr svchp, IntPtr errhp, IntPtr dst_locp, IntPtr src_locp, UInt64 amount, UInt64 dst_offset, UInt64 src_offset) +0 System.Data.OracleClient.OCI.DetermineClientVersion() +284 [InvalidOperationException: Attempt to load Oracle client libraries threw BadImageFormatException. This problem will occur when running in 64 bit mode with the 32 bit Oracle client components installed.] System.Data.OracleClient.OCI.DetermineClientVersion() +1058 System.Data.OracleClient.OracleInternalConnection.OpenOnLocalTransaction(String userName, String password, String serverName, Boolean integratedSecurity, Boolean unicode, Boolean omitOracleConnectionName) +70 System.Data.OracleClient.OracleInternalConnection..ctor(OracleConnectionString connectionOptions) +136 System.Data.OracleClient.OracleConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningObject) +58 System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options) +49 System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject) +984 System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject) +91 System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject) +1908 System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) +85 System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) +270 System.Data.OracleClient.OracleConnection.Open() +48 Delivery_Delete.Button1_Click1(Object sender, EventArgs e) in e:\Portal_Final\Delivery Delete.aspx.cs:24 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +154 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +3394

score 0 · Accepted Answer · edited May 23 '17 at 11:51

I haven't personally worked with an Oracle database, but from your stack trace I see the following error:

Attempt to load Oracle client libraries threw BadImageFormatException. This problem will occur when running in 64 bit mode with the 32 bit Oracle client components installed.

Take a look at this similar issue here: BadImageFormatException. This will occur when running in 64 bit mode with the 32 bit Oracle client components installed

This is unrelated to your original question and I am no security analyst but your code has a couple of warning signs of SQL Injection attack, if this is meant for a production site make sure that any data coming from the client is sanitized before using it in your query.

The following code could be used by a malicious user to do pretty much anything in your database:

new OracleDataAdapter("SELECT TO_NO, MERGE, TRUCK_NO, CUST_NM, QTY, PLANT_CD, DATA_STS, ORD_STS, MPNSEQ_NO, DEL_NO FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "' OR TRUCK_NO = '" + TextBox1.Text + "'", con);

If a user enters the following text into TextBox1

'; SELECT * FROM WI_TO --

The resulting query would be:

SELECT TO_NO, MERGE, TRUCK_NO, CUST_NM, QTY, PLANT_CD, DATA_STS, ORD_STS, MPNSEQ_NO, DEL_NO FROM WI_TO WHERE TO_NO = ''; SELECT * FROM WI_TO --' OR TRUCK_NO = ''; SELECT * FROM WI_TO --'

The select statement may be relatively harmless in this case but imagine if it was a delete instead, It could have been a statement to delete any data in any tables in the database.

Below are a couple of links to learn a little more information about these kind of attacks.

https://msdn.microsoft.com/en-us/library/ff648339.aspx

ASP.net website is not working properly while configuring in Internet Information Services

1 Answers1