CAPEC-110: SQL Injection through SOAP Parameter Tampering

SQL Injection through SOAP Parameter Tampering


Typical_Severify: Very High



An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message.


ChildOf: CAPEC-66 |SQL Injection

CanFollow: CAPEC-280 |DEPRECATED: SOAP Parameter Tampering

Execution Flow Attack Setp

Setp 1 Explore

[Detect Incorrect SOAP Parameter Handling] The attacker tampers with the SOAP message parameters and looks for indications that the tampering caused a change in behavior of the targeted application.

Setp 2 Experiment

[Probe for SQL Injection vulnerability] The attacker injects SQL syntax into vulnerable SOAP parameters identified during the Explore phase to search for unfiltered execution of the SQL syntax in a query.

Setp 3 Exploit

[Inject SQL via SOAP Parameters] The attacker injects SQL via SOAP parameters identified as vulnerable during Explore phase to launch a first or second order SQL injection attack.


SOAP messages are used as a communication mechanism in the system

SOAP parameters are not properly validated at the service provider

The service provider does not properly utilize parameter binding when building SQL queries


Level Medium

If the attacker is able to gain good understanding of the system's database schema

Level High

If the attacker has to perform SQL injection blindly


None: No specialized resources are required to execute this type of attack.


Scope Impact Likelihood
I n t e g r i t y Modify Data
A v a i l a b i l i t y Unreliable Execution
C o n f i d e n t i a l i t y Read Data
Confidentiality Access Control Authorization Gain Privileges
Confidentiality Integrity Availability Execute Unauthorized Commands


Properly validate and sanitize/reject user input at the service provider.

Ensure that prepared statements or other mechanism that enables parameter binding is used when accessing the database in a way that would prevent the attackers' supplied data from controlling the structure of the executed query.

At the database level, ensure that the database user used by the application in a particular context has the minimum needed privileges to the database that are needed to perform the operation. When possible, run queries against pre-generated views rather than the tables directly.


An attacker uses a travel booking system that leverages SOAP communication between the client and the travel booking service. An attacker begins to tamper with the outgoing SOAP messages by modifying their parameters to include characters that would break a dynamically constructed SQL query. He notices that the system fails to respond when these malicious inputs are injected in certain parameters transferred in a SOAP message. The attacker crafts a SQL query that modifies his payment amount in the travel system's database and passes it as one of the parameters . A backend batch payment system later fetches the payment amount from the database (the modified payment amount) and sends to the credit card processor, enabling the attacker to purchase the airfare at a lower price. An attacker needs to have some knowledge of the system's database, perhaps by exploiting another weakness that results in information disclosure.


89 | SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

20 | 输入验证不恰当



2014-06-23 | CAPEC Content Team | The MITRE Corporation


2017-08-04 | CAPEC Content Team | The MITRE Corporation

Updated Resources_Required