ArcGIS Server 10.0 contains a blind SQL injection vulnerability

Description

A blind SQL injection vulnerability in ArcGIS Server 10.0 allows remote attackers to execute a subset of SQL commands via a query operation WHERE clause.

The ArcGIS Server 10.0 SP5 Security patch addresses two SQL injection vulnerabilities in ArcGIS Server when used with either enterprise geodatabases or relational databases through query layers. These vulnerabilities cannot be exploited on systems that only use file-based data.

The following issues that were reported to Esri, NIM085361 and NIM084249, have been fixed in this patch.

This vulnerability allows users to determine the fully qualified table name of the feature class, which reveals the database username and the name of the database server.

Cause

Under certain circumstances, ArcGIS Server reveals fully qualified table names for layers within a map service.

Solution or Workaround