IIS Site Getting Hacked? - mysql

I am running IIS 8.5 on a Windows 2012 R2 virtual server.
The server has MySQL Server 5.5.44 installed, and I connect to it using Classic ASP pages via a MySQL ODBC 5.1 Driver.
Recently I have been getting issues in my error log with errors such as:
[MySQL][ODBC 5.1 Driver][mysqld-5.5.44]Error on delete of 'C:\Windows\TEMP\#sql1718_1ca27_2d.MYI' (Errcode: 13)
And
[MySQL][ODBC 5.1 Driver][mysqld-5.5.44]Can't find file: 'v_pdf_log' (errno: 2)
I have been able to normally go into the MySQL admin application (SQLYog) and repair the database, and the problem is fixed.
However, I think someone is trying to break the site as some strange URLs are getting called, such as:
mysite/mypage.asp?id=999999.9"+%2f**%2fuNiOn%2f**%2faLl+%2f**%2fsElEcT+0x393133353134353632312e39+and+"0"="0
These are URLs from Moscow. Presumably this is an SQL Injection attack is it?
Can they somehow delete actual MD Files from the MySQL folder? Presumably not, but they have done something.
And yes, I'm a stupid person who didn't parameterise my queries in my code...

Use Parameterized queries and give the DB login the least privilege possible.
Also use stored procedures whenever possible

Related

Trying to migrate SQL Server to MySQL using MySQL Workbench. Error: "[Microsoft][ODBC Driver Manager] Invalid argument value" when migrating data

Long time lurker, first time poster; hoping anyone can help me out.
Im using MySQL Workbench 5.2.41 to migrate a database from SQL Server to MySQL 5.0.8
The entire process goes smoothly: both SQL and MySQL connection Tests are good, the skemea and table create as expected, everything checks out until the 'Bulk Data Transfer' step. At that point I receive this error:
...
Migrating data...
wbcopytables.exe --odbc-source=DSN=SQL Server 11;DATABASE=;UID=sa --target=root#127.0.0.1:3306 --progress --passwords-from-stdin --thread-count=1 --table [GSAClosers_v2] [dbo].[AccountBase] `dbo` `AccountBase`
`dbo`.`AccountBase`:Copying 84 columns of 169530 rows from table [GSAClosers_v2].[dbo].[AccountBase]
ERROR: `dbo`.`AccountBase`:SQLGetData: HY009:10:[Microsoft][ODBC Driver Manager] Invalid argument value `dbo`.`AccountBase`:
Finished copying 0 rows in 0m00s
Copy helper has finished
...
For connectors I'm using Microsoft SQL Server / ODBC Data Source / DSN: SQL Server and for MySQL the IP and port(3306).
SQL Server 2012 Management Studio connects and all operations work as expected.
O, side not: both are on the same localhost machine.
If anyone can shed some light on this I would be forever indebted. Thanks in advance
From here:
[Microsoft][ODBC Driver Manager] Invalid argument value.
Regarding to the error message and code you provided, which seems is
database is invalid or cannot be accessed. That means either the
database does not exist or the user does not have permission to access
the database.
It turns out you need specify the instance after the server name, so
in the server name in the dialog box for creating the ODBC Data
Source, you must enter it as either: MyServer\SQLEXPRESS or
.\SQLEXPRESS
I think you may have a problem connecting to your database from wbcopytables.exe. Keep in mind that this is a separate tool so the fact that you can connect from the rest of the Migration Wizard doesn't imply that you will connect in wbcopytables.exe.
The thing that worries me the most is that your DSN has whitespace characters. This might be interpreted by the Windows terminal as independent command line parameters. One thing you can do is to edit your DSN name removing the whitespaces and try again.
You may also want to connect without a DSN by putting all your connection parameters explicitely as explained in my blog post: How-To: Guide to Database Migration from Microsoft SQL Server using MySQL Workbench.
And, by the way, since MySQL Workbench 5.2.42 is out you should go and get it. The Migration Wizard is pretty new so important bug fixes are likely launched in each recent Workbench release.
In either case I think you should file a bug with your issues with a detailed explanation about how to reproduce it, possible solutions, etc.
Hope this helps.
Ok, got it figured out: un-install java. install java 1.6, use MySQL Migration Tool. change all data types to varchar, ints and bits. run migrations....eat data.

SQL Server Error 223 When Connecting

I recently changed SQL Server 2008 from windows authentication mode, to mixed. I created a new user 'taraw' and set a password. I'm connecting to localhost - which works perfect when using windows authentication, however if I want to use SQL Server authentication with my user - taraw, I get the following error:
Shared Memory Provider, error: 0 - No
process is on the other end of the
pipe (Microsoft SQL Server, Error 233)pipe (Microsoft SQL Server, Error 233)
I know the password is correct as I've just created it, I've also tried creating different users, to which I get the same result. I've read somewhere that Namespipes might be disabled? But I haven't found out where or even how to enable this. (EDIT: I have since found this, and it is enabled)
If anyone has any advice it would be MUCH appreciated.
Thanks
I have since solved this problem. I was previously restarting the server within SQL SERVER MANAGEMENT STUDIO, this was incorrect.
I simply restarted the SQL Server within SQL Server Configuration Manager and it worked.

Migrate Data and Schema from MySQL to SQL Server

Are there any free solutions for automatically migrating a database from MySQL to SQL Server Server that "just works"?
I've been attempting this simple (at least I thought so) task all day now. I've tried:
SQL Server Management Studio's Import Data feature
Create an empty database
Tasks -> Import Data...
.NET Framework Data Provider for Odbc
Valid DSN (verified it connects)
Copy data from one or more tables or views
Check 1 VERY simple table
Click Preview
Get Error:
The preview data could not be
retrieved. ADDITIONAL INFORMATION:
ERROR [42000] [MySQL][ODBC 5.1
Driver][mysqld-5.1.45-community]You
have an error in your SQL syntax;
check the manual that corresponds to
your MySQL server version for the
right syntax to use near
'"table_name"' at line 1 (myodbc5.dll)
A similar error occurs if I go through the rest of the wizard and perform the operation. The failed step is "Setting Source Connection" the error refers to retrieving column information and then lists the above error. It can retrieve column information just fine when I modify column mappings so I really don't know what the issue is.
I've also tried getting various MySql tools to output ddl statements that SQL Server understand but haven't succeeded.
I've tried with MySQL v5.1.11 to SQL Server 2005 and with MySQL v5.1.45 to SQL Server 2008 (with ODBC drivers 3.51.27.00 and 5.01.06.00 respectively)
There are two free toolkits provided by Microsoft.
Microsoft SQL Server Migration Assistant for MySQL v1.0
http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=14280
Microsoft SQL Server Migration Assistant for MySQL v5.1
http://www.microsoft.com/download/en/details.aspx?id=26712
I have used only the second one and it worked for me without any glitch.
It required registration with Microsoft for downloading a license file.
But it is free to use for everyone.
This is really old now, but if you use MySQL Connector NET and set SQL Server Mode = true in the connection string, this will resolve your error.
Recently, I have successfully migrated the MySQL database to MSSQL database. Below are detailed steps:
Operating System: AWS Microsoft Windows Server 2012 R2 with SQL Server Standard
Tools Used:
SQL Server 2014 Management Studio SQL Developer,
Microsoft SQL Server Migration Assistant v6.0.1 for MySQL,
Remote Desktop Client, and
Third Party MySql ODBC Driver 5.1.13
1. Setup AWS Windows Server
2. From the AWS console ec2 instance list, right click on the windows server and select connect. You would see the similar screen below.
3. Click on the Get Password button which will be required for Remote Desktop connection[#4] and follow the instructions.
4. Connect to that EC2[#1] instance with the Remote Desktop Client by default available in your Ubuntu local machine. Use the credentials from #2.
5. Once you get connected using the remote client, you should be able to access the remote MSSQL server. Install the following tools.
Install Chrome : Since internet explorer has some security, install chrome.
Install Microsoft SQL Server Migration Assistant v6.0.1 for MySQL
https://www.microsoft.com/en-us/download/details.aspx?id=51218
Install Third Party MySql ODBC Driver 5.1.13
https://dev.mysql.com/downloads/connector/odbc/5.1.html
6. Configure ODBC Data Sources(64-bit) :
Open Administrative tools → click on ODBC Data Sources(64-bit) and
follow the steps to connect to MySQL database.
7. Open SQL Server 2014 Management Studio SQL Developer and connect using windows authentication.
Create destination MSSql database for MySql migration.
8. Open Microsoft SQL Server Migration Assistant : For detail visit this link: https://blogs.msdn.microsoft.com/ssma/2011/02/07/mysql-to-sql-server-migration-how-to-use-ssma/
Create new project
Connect to MySql
Connect to MSSql
Convert Schema
Migrate Data
8. You might have some problem listed here. Please read in detail where I have written the detail resolution.
MySql 5.6 to MSSql server 2014 migration : ExecuteReader requires an open and available Connection
I am afraid there is no simple solution. SQL used in MySQL and T-SQL used in SQL Server 200X are different dialects of SQL. It is not only simple changing say "auto_increment" to "identity", but reserved words that creates a problem.
For example
CREATE TABLE test (
user varchar(50)
)
will work in MySQL and fail in SQL Server 2008.
To cut long story short - unfortunately, you will need to do it by hand.
Export the file from MySQL to a CSV file.
Export the create statements for the tables from MySQL
Cry.
3a. Disable foreign key checks in SQL server
Tune the create statements in SQLserver until they work.
Import the CSV files in to MySQL.
5a. Enable foreign key checks in SQL server.
Also see these answers:
migrate-from-mysql-to-sql-server-2008
Had similiar issue about this error 42000, and for me I figured out that setting the MySQL global mode to ansi_quotes would solve it:
set global sql_mode=ansi_quotes;
There are commercial solutions, but not free solutions. Depending on complexity of your database, rewriting SQL for target dialect can be trivial task - or a very hard one.
Rewriting CREATE TABLE statements is never hard, it can be done by hand with no surprises. Procedures, functions and triggers are problematic.

Migrating from MS SQL to MySQL: SQLOLEDB? Migration kit login error?

I've been put in charge of migrating a customer's website of MS SQL/ASP to PHP/MYSQL. I have zero experience with MS SQL.
I'm trying to figure out the best way to get the current data migrated to MySQL so I can begin PHP development.
Some details:
I downloaded SQL Server Mangement Studio Express. I found the following string in a connection file:
MM_connCompanyName_STRING = "provider=SQLOLEDB;data source=IP_ADDRESS;database=DATABASENAME;uid=USERNAMEpwd=PASSWORD;"
Using the IP, username, and password from this string, I could successfully connect using Studio Express.
I downloaded the MySQL Migration Toolkit and entered the same info, but get the following error:
Connecting to source database and retrieve schemata names.
Initializing JDBC driver ...
Driver class MS SQL JDBC Driver
Opening connection ...
Connection jdbc:jtds:sqlserver://IP_ADDRESS:1433/DATABASENAME;user=USERNAME;password=PASSWORD;";charset=utf-8;domain=
The list of schema names could not be retrieved (error: 0).
ReverseEngineeringMssql.getSchemata :Login failed for user 'USERNAME'.
I don't have admin or physical access to the current SQL server. I've tried to run some exports through Studio Express, but it saves them to the file system, which I don't have access to.
I can reach the current/old webmaster, but because he no longer works for the company, his responses are slow and usually un-helpful. So no help there...
The former admin sent me an MDF file ... no idea what to do with that.
I found this note above the connection info on the current server (if it means anything):
'this connection is being used because
ODBC was causing weird errors,
switching to OLEDB fixed them
My questions:
Any idea why this would be failing with the same login credentials that works with Studio Express? I'm assuming it has something to do with the driver, but I don't know what next steps to take.
Is there a better/easier/more effective way to migrate this data? (I'm hoping I don't find myself running "SELECT *" statements in Studio Express and copy/pasting data into Excel...please god, no)
Thanks in advance for your help.
Eww, this is going to be scary (connection string indicates it was tool generated from Dreamweaver, never a good sign).
Any idea which version of SQL Server? You should be able to SELECT ##VERSION. 10.x is 2008, 9.x is 2005 and 8.x is 2000. If it is 7.x run.
The MDF file is the actual database. If I were you, I would buy a developer edition of SQL 2005 (or 8 if it is 2008 which is unlikely), it will be worth the $99 or so it costs.
This will give you the ability to locally install the DB by ATTACHing the MDF file. Once you have a locally running copy, you can use the SQL Server ETL tools with the MySql ODBC drivers to push the data to MySql in a repeatable manner.
I believe you can export data from MSSQL choosing different SQL dialects; I believe there's one that's reasonably MySQL compatible. It doesn't solve all your problems, of course, because while you may get the structure properly, stored procedures and triggers and the like will take a bit more work. But that should get you started.

Collating Sequence Not supported by operating system

I am moving from SQL 2000 to SQL 2008. The SQL 2000 is on a Server 2003. SQL 2008 is on a Server 2008. I have imported my database successfully. I am able to perform queries and they work fine. I use a VB6 program running in the IDE to update the database.
When my VB6 program runs on a server 2003 the program will connect using the following connection string:
Provider=SQLOLEDB;DATABASE=mydbname;SERVER=my ip;DRIVER={SQL SERVER};UID=myuser;PWD=mypw;
Using the above connection string, I can connect with no errors to either SQL 2000 or the new SQL 2008 database. On the Server 2008, there is no SQLOLEDB driver show, so I have to use the new SQLNCLI10 provider
CCTdbConnectionString = "Provider=SQLNCLI10;Server=myServer\My InstanceName;Database=MyDB;UID=myuser;PWD=mypw;
Here's the problem. When I am running on the Server 2008 I get the error 3228 Selected collating sequence not supported by the operating system. If I hit debug and try again, or stop the program and try again it gets past that error until I reopen the IDE. Then I get a 2nd error encountered is an error 3027 Can Not Update. Database or object is read-only! This never goes away and I'm dead.
After Much research, I have found the answer. SQL 2005 and up apparently require a Unique Key Index exist on every single table that is accessed using ODBC or OLEDB.
This Cures the problem.
Compile the code: don't use the IDE?
Related KS KB article 246167