[MS-SQL] Script 삽입 공격을 당했는지 확인

* Script 삽입 공격을 당했는지 확인

CREATE TABLE TMP_SCRIPT
(
TB_NAME VARCHAR (500),
CO_NAME VARCHAR (500)
)

DECLARE @T VARCHAR(255), @C VARCHAR(255);
DECLARE TABLE_CURSOR CURSOR FOR

SELECT A.NAME, B.NAME
FROM SYSOBJECTS A, SYSCOLUMNS B
WHERE A.ID = B.ID AND A.XTYPE = 'U' AND
(B.XTYPE = 99 OR
B.XTYPE = 35 OR
B.XTYPE = 231 OR
B.XTYPE = 167)

OPEN TABLE_CURSOR;

FETCH NEXT FROM TABLE_CURSOR INTO @T, @C;
WHILE (@@FETCH_STATUS = 0)

BEGIN

--EXEC (' INSERT INTO TMP_SCRIPT SELECT ''' +@T + ''', ''' +@C+ ''' FROM [' +@T + '] WHERE [' +@C+ '] LIKE ''%<script src=http://www.xxx.yyy/zzz.js></script>%'' ' );
EXEC (' INSERT INTO TMP_SCRIPT SELECT ''' +@T + ''', ''' +@C+ ''' FROM [' +@T + '] WHERE [' +@C+ '] LIKE ''%<script%</script>%'' ' );

FETCH NEXT FROM TABLE_CURSOR INTO @T, @C;
END;

CLOSE TABLE_CURSOR;
DEALLOCATE TABLE_CURSOR;

SELECT * FROM TMP_SCRIPT

DROP TABLE TMP_SCRIPT