Problem:  ArcGIS Server 10.0 contains a blind SQL injection vulnerability

【相关信息】
Article ID: 40677
Bug Id: N/A
Software:
ArcGIS Server (10.0 and prior) 10
Platforms: N/A

【问题描述】
A blind SQL injection vulnerability in ArcGIS Server 10.0 allows remote attackers to execute a subset of SQL commands via a query operation WHERE clause.

The ArcGIS Server 10.0 SP5 Security patch addresses two SQL injection vulnerabilities in ArcGIS Server when used with either enterprise geodatabases or relational databases through query layers. These vulnerabilities cannot be exploited on systems that only use file-based data.

The following issues that were reported to Esri, NIM085361 and NIM084249, have been fixed in this patch.

This vulnerability allows users to determine the fully qualified table name of the feature class, which reveals the database username and the name of the database server.

【原因】
Under certain circumstances, ArcGIS Server reveals fully qualified table names for layers within a map service.