title: ÐÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸Ñ Ð·Ð°ÑÐ¸ÑÑ Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹ Ð¾Ñ Ð¼Ð½Ð¾Ð³Ð¾ÑÑÐ¾Ð²Ð½ÐµÐ²ÑÑ SQL-Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Organization of protection of web applications against second order SQL injection attacks
Creators: name: ÐÑÐ»ÑÐµÐ², ÐÐ»ÐµÐºÑÐ°Ð½Ð´Ñ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2025
Subjects: sql
Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ðµ
Ð±Ð°Ð·Ð° Ð´Ð°Ð½Ð½ÑÑ
ÑÑÐ±Ð´
sql-Ð¸Ð½ÑÐµÐºÑÐ¸Ð¸
Ð¼Ð½Ð¾Ð³Ð¾ÑÑÐ¾Ð²Ð½ÐµÐ²ÑÐµ sql-Ð¸Ð½ÑÐµÐºÑÐ¸Ð¸
web application
database
sql injection
second order sql injection
multi-level sql injection

description: Ð¦ÐµÐ»Ñ Ð´Ð¸Ð¿Ð»Ð¾Ð¼Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ Ð·Ð°ÐºÐ»ÑÑÐ°ÐµÑÑÑ Ð² Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ð¸ ÑÐ¾ÑÐ½Ð¾ÑÑÐ¸ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¼Ð½Ð¾Ð³Ð¾ÑÑÐ¾Ð²Ð½ÐµÐ²ÑÑ SQL-Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ Ð¼ÐµÑÐ¾Ð´Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÑÐ°ÐºÐ¸Ñ Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¼Ð¾Ð´Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ Ð¸ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð·Ð°Ð¿ÑÐ¾ÑÐ¾Ð² Ðº Ð±Ð°Ð·Ðµ Ð´Ð°Ð½Ð½ÑÑ Ð½Ð° ÑÑÐ°Ð¿Ðµ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¾ÑÑÐ°Ð½ÐµÐ½Ð½ÑÑ Ð´Ð°Ð½Ð½ÑÑ Ð² Ð±Ð°Ð·Ðµ. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð¾ÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÐ¸ Ð¼Ð½Ð¾Ð³Ð¾ÑÑÐ¾Ð²Ð½ÐµÐ²ÑÑ SQL-Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹ Ð¸ Ð¸Ñ Ð¾ÑÐ»Ð¸ÑÐ¸Ñ Ð¾Ñ ÑÑÐ°Ð½Ð´Ð°ÑÑÐ½ÑÑ SQL-Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹. 2. ÐÐ¿Ð¸ÑÐ°ÑÑ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ Ð¿Ð¾Ð´ÑÐ¾Ð´Ñ Ðº Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¼Ð½Ð¾Ð³Ð¾ÑÑÐ¾Ð²Ð½ÐµÐ²ÑÑ SQL-Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹, Ð²ÐºÐ»ÑÑÐ°Ñ Ð¸Ñ ÑÐ¸Ð»ÑÐ½ÑÐµ Ð¸ ÑÐ»Ð°Ð±ÑÐµ ÑÑÐ¾ÑÐ¾Ð½Ñ. 3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¼Ð½Ð¾Ð³Ð¾ÑÑÐ¾Ð²Ð½ÐµÐ²ÑÑ SQL-Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹, ÑÑÐ¸ÑÑÐ²Ð°ÑÑÑÑ Ð¾ÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÐ¸ ÑÑÐ°Ð½ÐµÐ½Ð¸Ñ Ð¸ Ð¾Ð±ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð´Ð°Ð½Ð½ÑÑ. 4. Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÐ¹ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð° Ð¸ Ð¾ÑÐµÐ½Ð¸ÑÑ ÐµÐ³Ð¾ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ñ Ð°ÑÐ°ÐºÐ¸, Ð¾ÑÐ½Ð¾Ð²Ð°Ð½Ð½ÑÐµ Ð½Ð° Ð¼Ð½Ð¾Ð³Ð¾ÑÑÐ¾Ð²Ð½ÐµÐ²ÑÑ SQL-Ð¸Ð½ÑÐµÐºÑÐ¸ÑÑ. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹ Ð¾Ñ ÑÐ°ÐºÐ¸Ñ Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¾ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¼Ð½Ð¾Ð³Ð¾ÑÑÐ¾Ð²Ð½ÐµÐ²ÑÑ SQL-Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¼Ð¾Ð´Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ ÑÑÐ°Ð½Ð´Ð°ÑÑÐ½ÑÑ SQL- Ð·Ð°Ð¿ÑÐ¾ÑÐ¾Ð², ÑÐ°ÐºÐ¶Ðµ Ð±ÑÐ»Ð° Ð¿ÑÐ¾Ð´ÐµÐ¼Ð¾Ð½ÑÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð° ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ ÑÑÐµÐ´ÑÑÐ²Ð°. ÐÑÐ» ÑÐ´ÐµÐ»Ð°Ð½ Ð²ÑÐ²Ð¾Ð´, ÑÑÐ¾ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑ Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹ Ð¾Ñ ÑÐ°ÐºÐ¾Ð³Ð¾ ÑÐ¾Ð´Ð° Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹ Ð¼Ð°Ð»Ð¾ Ð¸Ð·ÑÑÐµÐ½Ð°. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¼Ð½Ð¾Ð³Ð¾ÑÑÐ¾Ð²Ð½ÐµÐ²ÑÑ SQL-Ð¸Ð½ÑÐµÐºÑÐ¸Ð¹ Ð² ÑÐµÐ°Ð»ÑÐ½ÑÑ Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸ÑÑ.
description: The purpose of the study is to improve the accuracy of detecting second-order SQL injections. The subject of the work is methods for detecting such injections based on modification and analysis of database queries at the stage of using stored data in the database. Tasks to be solved during the research: 1. To analyze the features of multi-level SQL injections and their differences from standard SQL injections. 2. Describe existing approaches to detecting multi-level SQL injections, including their strengths and weaknesses. 3. To develop the algorithm for detecting multi-level SQL injections, taking into account the specifics of data storage and processing. 4. Implement a software prototype of the algorithm and evaluate its efficiency. In the course of the work, attacks based on multi-level SQL injections were investigated. Modern research in the field of ensuring the security of web applications from such injections was analyzed. As a result of the work, a tool for detecting multi-level SQL injections based on modification of standard SQL queries was developed, and the effectiveness of the tool was also demonstrated. It was concluded that the security of web applications from this kind of injection has been little studied. The results obtained can be used as a basis for designing multi-level SQL injection detection systems in real web applications.