Online scan detecting SQL Injection vulnerability

Question

I have had my boss do vulnerability scans on our servers using online services and it's frustrating trying to explain that we don't actually suffer from the vulnerabilities that the reports say we do.

Am I kidding myself or am I right in saying that these services "assume" because you allow posting to your site that it's vulnerable? I've tested a bunch of injection attacks and our server returns never allows them to execute because the code stops it.

What is the best way to make my server immune to these scans? I get a few things, like stopping apache/php/openSSL from reporting it's versions, especially because I use security patched versions from the Debian security team which doesn't necessarily match the patched version for PHP.

Answer 1

The problem with these reports is that they just assume that if you allow user data entry on your site, then you are vulnerable to SQL injection attacks. There is no way for them to tell without actually looking at your SQL, or performing an injection attack, so they just flag it as a potential problem.

The only real way to prove to your boss that your are safe, is either to get a security expert come in and check your site, or get your boss to understand what an injection attack is, and show him it not working on your site.