Re: SQL injection

[nummish () 0x90 org]

' OR SYSTEM_USER='sa'; --

If it logs you on, you'll know you're running as the sysadmin. From there
you should have access to stored procs such as xp_cmdshell, etc.

If that's the case, you have a lot of options at your disposal. If not,
you can at least retrieve all of the data in the database, there are
multiple tools to do this (Data Thief, SPI's SQL Injector and Absinthe).
Also, you can most likely write to it.

You might want to look at some whitepapers on SQL Injection for SQL Server
databases to get a better idea of what attackers are capable of. I'd
suggest starting here:
http://www.ngssoftware.com/papers.htm
and here:
http://spidynamics.com/support/whitepapers/index.html


-nummish

> I have just discovered that I can successfully inject the following SQL:
>
> ' OR 1=1; --
>
> into the Username field of a logon form on a "secure" site in my
corporate network (Windows 2000, SQL 7.0).  When I do this, leaving the
password field blank, I am logged into the system as the first user in the
"Users" table in the DB which is being authenticated against.  LOL.
> If I can get that far, can't I theoretically:
>
> ' OR 1=1; DELETE Users; --
>
> or something similar?  Couldn't I EXEC some system sprocs this way too?
How much damage/rooting can be done here?  I need to present a detailed
report to the admins.
> Thanks,
>
> Francesco
> Francesco Sanfilippo
> -------------------------------------------
> Blackcoil Productions - http://blackcoil.com
> URL123 Link Service - http://url123.com