Andreas Wolter • 1/16/2014

SQL Server Row- and Cell-Level Security – Disclosure vulnerability

Read Original

This technical article details a security vulnerability in SQL Server's Row-Level and Cell-Level Security implementations that use views with functions like IS_MEMBER(). It demonstrates how an attacker can craft queries to bypass these filters and disclose protected data through error-based attacks, similar to SQL injection. The post includes example code, architecture diagrams, and begins to discuss mitigation strategies like using stored procedures.

0 comments
#Database Security #SQL Server #Security Vulnerability
SQL Server Row- and Cell-Level Security – Disclosure vulnerability

Comments

No comments yet

Be the first to share your thoughts!

Browser Extension

Get instant access to AllDevBlogs from your browser

Top of the Week

1
Quoting Thariq Shihipar
Simon Willison • 2 votes
2
Top picks — 2026 January
Paweł Grzybek • 1 votes
3
In Praise of –dry-run
Henrik Warne • 1 votes
4
Deep Learning is Powerful Because It Makes Hard Things Easy - Reflections 10 Years On
Ferenc Huszár • 1 votes
5
Vibe coding your first iOS app
William Denniss • 1 votes
6
AGI, ASI, A*I – Do we have all we need to get there?
John D. Cook • 1 votes
7
Dew Drop – January 15, 2026 (#4583)
Alvin Ashcraft • 1 votes