Andreas Wolter • 1/16/2014

SQL Server Row- and Cell-Level Security – Disclosure vulnerability

This technical article details a security vulnerability in SQL Server's Row-Level and Cell-Level Security implementations that use views with functions like IS_MEMBER(). It demonstrates how an attacker can craft queries to bypass these filters and disclose protected data through error-based attacks, similar to SQL injection. The post includes example code, architecture diagrams, and begins to discuss mitigation strategies like using stored procedures.

0 comments

#Database Security #SQL Server #Security Vulnerability