Flawed web apps up by 10%

There has been a ten per cent increase in the total number of web applications found to have at least one high-risk security issue.

Of the applications tested by NTA Monitor, 27 per cent contained at least one high-risk issue compared with 17 per cent last year.

The organisation found that the three most common high risks were an SQL injection attack, which enables attackers to modify the database queries initiated from an application; a cross-site scripting attack; or a cross-request forgery attack, which enables a hostile website to make arbitrary HTTP requests to applications.

The findings form part of NTA's 2009 annual web application security report, which analysed data gathered from web application security tests performed for a wide range of industry sectors across a 12-month period.

The dramatic change was seen within NTA's charity and not-for-profit clients, where the average number of vulnerabilities more than tripled from 2008 to 2009. Clients in the services sector, despite seeing a decrease in the average number of threats from 2008 to 2009, had the highest number of high risks per test compared with all other sectors.

Roy Hills, technical director at NTA Monitor, said: “All user-supplied data should be properly sanitised before returning it to the browser or storing it in a database. This reduces the threat of SQL injection, which is a consistently prevalent high risk throughout 2008 and 2009.”

See original article on scmagazineus.com