You have a point; once a SQL injection attack is successful, the hacker has already gained access to whatever valuable data might be hosted on the server. This could be anything from usernames/passwords, account information, or personal information. It depends what the server was used for.

However, many times the hacker’s goal is to also propagate malware by adding malicious code to the website which is hosted on the server. In these cases, the exploit would most likely be blocked by a utility such as NoScript.

When it comes to hacked servers, it is the server admin who is responsible for fixing the issue. This leaves a legit site in a compromised state until the site admin is notified and is able to remedy the infection. In addition, site admins often do not notify their users that personal information might have been accessed, and therefore people are unable to take the necessary steps to protect themselves. Not a lot can be done to fix this, though users of sites that are attacked should be encouraged to be vocal on the site forum to alert others that their personal data may have been compromised.

MGuthrie
Webroot Threat Blog admin

Do you think you can clarify your last point about defending against SQL injection attacks by switching to Firefox and using NoScript?

As I understand it (and you describe it), SQL injection attacks are run against a database hosted on a server, not a client or end-user. If such an attack is successful, the cracker is able to view or modify the data within that database, ranging from product pricing to username/password combinations and other personal information.

What I don’t understand is how a client-side change would affect this problem. If the attacker leveraged a SQL injection into forcing a legitimate server to host malicious JavaScript/Flash components, I can see your point. But if the only attack was a SQL injection, then the problem has to be addressed by the site’s administrators, not it’s users.

For the record, I do believe that we should all be using Firefox with NoScript (or something similar), just want to understand your post better.