A security review was done against one of our ASP.net applications and returned in the test results was a SQL Injection Exposures considered to be a high risk item.
The test that was performed passed a SQL statement as the value of the __EVENTTARGET and the __EVENTARGUMENT. I am wondering since these 2 values are ASP.net auto-generated hidden fields used for the Auto-Postback feature of the framework and hold information specific to the controls initiating the postback, is there really the potential for SQL injection if you are never manually calling and or pulling values out of these parameters in your code behind?
..if you are never manually calling and or pulling values out of these parameters in your code behind...
Assuming the above statement to be true, I don't see those parameters being susceptible to SQL Injection. Perhaps you ran an automated scan and this is a false alarm?