0

Can Microsoft Access macros (not VBA) be vulnerable to SQL injection?

There are constructs for code flow, temporary variables etc. Is it possible to write a macro that would incorporate user input into an SQL statement, such that the SQL statement would have unintended and undesirable consequences?

The SQL statement could be used in the RunSQL action. Alternatively, the SetProperty action could be used to change the RecordSource or RowSource property.

If yes, how could this be done?

1 Answer 1

1

Certainly, though because macros offer very limited capabilities, such cases are mostly academic.

Let's say I'm trying to implement a login system that disallows access to the database, without relying on VBA. I'm creating a form, adding two text boxes for username and password, and I'm making the form modal and removing close buttons to disallow the user to dismiss the form, making my macro the only way to gain access to the database (way insecure in many ways).

The macro:

If DCount("*","tblUsers","UserName = '" & Forms![LoginForm]!Username & "' AND [Password] = '" & Forms![LoginForm]!Password & "'") <> 0
    CloseWindow
        Object type = Form
        Object Name = LoginForm
        Save = Prompt

My injection payload is a classic: enter ' OR 1=1 OR 'A' = ' as a username, blank password, you're in.

However, this example is pretty ridiculous. The string delimiters and concatenation operators be omitted to use form-based parameters, and injection is suddenly impossible.

The RunSQL macro action, however, doesn't support dynamic SQL at all, so isn't vulnerable to SQL injection afaik. You can use form parameters in it, though.

As Zev Spitz pointed out himself in the comments, SetProperty can't modify row or record source so can't be used for SQL injection attacks.

6
  • pretty ridiculous -- "That hardly ever happens" is another way of saying "it definitely will happen" -- Douglas Crockford.
    – Zev Spitz
    Oct 14, 2018 at 14:34
  • AFAICT there's only a limited set of properties that can be changed with the SetProperty macro action -- Enabled, Visible, Locked, Top, Left, Width, Height, ForeColor, BackColor, Caption, Value -- so it's not vulnerable to SQL injection either.
    – Zev Spitz
    Oct 14, 2018 at 16:33
  • When you say you can inject using SetProperty, what do you mean? AFAICT it's not possible to set RowSource or RecordSource using SetProperty.
    – Zev Spitz
    Oct 14, 2018 at 17:57
  • Oh, you're right. You can't set row or recordsource, only other properties. I haven't properly considered it as an attack vector, as it's limited to only select single select queries anyway, so the worst it could do is expose information from secured tables, and there's no such thing as secured tables in an open Access database (table content is exposed through OLE automation). But apparently it's not an attack vector at all.
    – Erik A
    Oct 14, 2018 at 19:17
  • 1
    And regarding that hardly ever happens, it costs extra effort to make your application vulnerable to SQL injection (DCount("Field", "Table", [Password] = '" & Forms![LoginForm]!Password & "'") instead of DCount("Field", "Table", [Password] = Forms![LoginForm]!Password"). Thus it's reserved for programmers that are not only unaware of SQL injection, but also don't really know how to write concise code in these macros.
    – Erik A
    Oct 14, 2018 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.