Syntax-Based Detection Enhancements (7.6.3)

FortiWeb enhances its SQL Injection Syntax-Based Detection (SBD) module to improve accuracy in detecting stacked SQL queries while reducing false positives. These enhancements introduce stricter syntax validation, refined SQL statement tracking, and improved error handling to mitigate security risks and unnecessary alerts.

Key Enhancements

Improved Detection of Stacked SQL Queries

• Stacked queries allow multiple SQL statements in a single request, often used in SQL injection attacks.

• The SBD module now accurately identifies stacked queries by tracking valid SQL statements while ignoring syntactically incorrect ones.

• A counter increments only when a valid SQL statement is fully parsed and meets specific conditions, ensuring precise detection.

Enhanced Error Handling

• Parsing is immediately aborted when an SQL syntax error is detected, preventing invalid statements from contributing to false positives.

• The parser stops processing a statement if it encounters an unexpected token after a completed SQL statement.

Stricter SQL Syntax Validation

• The module validates the order of SQL keywords, ensures necessary elements are present, and detects unbalanced parentheses.

• Basic token validation is applied to detect missing parameters in SELECT, INSERT, and other critical SQL commands.

Expanded Database and Command Support

• Syntax validation improvements apply to:

  • SELECT and INSERT statements.

  • Supported databases: MySQL, Microsoft SQL Server, Open Data Product Specification (ODPS), Oracle SQL, PostgreSQL, and IBM DB2.

• Additional enhancements reduce false positives for BULK, BACKUP, and DECLARE statements.