Are the ASP.net __EVENTTARGET and __EVENTARGUMENT susceptible to SQL injection?

Question

A security review was done against one of our ASP.net applications and returned in the test results was a SQL Injection Exposures considered to be a high risk item.

The test that was performed passed a SQL statement as the value of the __EVENTTARGET and the __EVENTARGUMENT. I am wondering since these 2 values are ASP.net auto-generated hidden fields used for the Auto-Postback feature of the framework and hold information specific to the controls initiating the postback, is there really the potential for SQL injection if you are never manually calling and or pulling values out of these parameters in your code behind?

Answer 1

..if you are never manually calling and or pulling values out of these parameters in your code behind...

Assuming the above statement to be true, I don't see those parameters being susceptible to SQL Injection. Perhaps you ran an automated scan and this is a false alarm?

Answer 2

You should always assume that dirty data can be passed from your form. Allowing it to be loaded from a postback, the __EVENTARGUMENT can be altered from the client side via javascript.

Always use good practices to make sure you don't allow sql-injection; and used parametrized SQL statements or another safe method.

http://msdn.microsoft.com/en-us/library/ms998271.aspx