0

I'm probably just being paranoid again about security. The latest thing keeping me up at night is the checks that one of our websites uses. It runs ColdFusion 9 on windows environment and we check a user input by isNumeric to verify that a string or input it is indeed a number. If it isn't a number stop execution and show message to user, else do what needs to be done normally. My question is, is there a way to break this check? Basically some kind of format that isNumeric will report as a number but can actually include something bad? 

<cfparam name="userInput" default="0">
<cfif isNumeric(userInput)>
    // Should be a number id 500
    // Use value to do SQL stuff because should be number
    // I know, not the best practice. Plan to fix all of these but the 
    // amount of code is staggering to fix all of these. Figured 
    // start with one thing then move on
    <cfquery>
       SELECT * FROM db WHERE serial = #userInput#
    </cfquery>
<cfelse>
    // Not a number ie '500sws'
</cfif>

Is there something that can be passed into userInput that can fool it to report true but actually not be?

Reason why I'm asking is cause this site is old. Things are out dated. I'm in process of working my way through a really large amount of code and there are points of vulnerability that I will be fixing as I go but if isNumeric can be fooled, then I have more work to do.

Not sure if I'm explaining it right. Let me know if there needs to be clarification.

If this need to be moved else where let me know. Thanks everyone.

jkw4703
  • 352
  • 3
  • 17
  • If you're worried about SQL injection you should be using for the variables passed into queries. You could add a type to the tag as well, but the tag is the most important. – Scott Jibben Mar 08 '17 at 22:15
  • That is my eventual goal, however due to how the site was built and the amount of cfquery tags used, I'm mainly looking for a stop gap while I move through and clean up the remaining files. I'm unable to use cfparam due to how the data is passed but cfqueryparam and stored procedures are my goal but those are going to take me some time. – jkw4703 Mar 08 '17 at 22:24
  • You might want to check out this question on SO: http://stackoverflow.com/questions/19140219/coldfusion-9-int-and-type-numeric-nasty-bug. It talks about the basic number validation system for versions before CF11 which can change how numbers are validated. – Scott Jibben Mar 09 '17 at 00:17
  • 1
    You could also use a reReplace() (regex replace) to strip out all characters except 0-9 before you use the isNumeric(). That would clean out SQL injection code leaving only numbers. is still the safest route... – Scott Jibben Mar 09 '17 at 00:20
  • reReplace is a great idea. I never considered that. – jkw4703 Mar 09 '17 at 00:21

0 Answers0