I'm developing a site using DNN 6.1.5, but our IA team keeps returning a lot of errors from Rational AppScan, and since I don't actually have access to that product, I can't replicate or verify any of these. In fact, they're actively trying to do black box pen tests on my development server, so I need to harden DNN to the crazy level of secure.

The biggest problem they are seeing with their scans so far has to do with sql injections and blind sql injections. They want user input further sanitized, however, DNN has the default .net input validation disabled. Is there any way to harden against sql injections any further other than creating the dual database account trick? They also want me to "remove all shell interpreters" with many references to the print options. I'm not even sure what they're talking about here. To the best of my knowledge, this is usually in reference to CGI calls and commands,

 Thanks very much in advance!
-626

Ok, thanks very much! It seems to be focusing on blind injections on the CSS modules (which the test user doesn't even have access too) and under very specific forms from the user profile edit module (user phone number for some reason). I though I was going a little crazy because I couldn't think of anything else to try aside from going though the stored procedures one at a time, line by line.

Is there a known list of false positives related to Rational AppScan and if so, is it available on the wiki? Is there any known cause or source for these false positives or is AppScan just a twitchy product? Thanks again!