Full Disclosure mailing list archives
Re: Latest MS SQL Server vulnerabilities revealed.
From: Cesar <cesarc56 () yahoo com>
Date: Wed, 30 Apr 2003 17:55:39 -0700 (PDT)
MS SQL Server DOES allow multiple statements, you should be confused with mysql. The ideas presented in paper work most of the time on web applications vulnerable to SQL injection, the only problem is when firewalls block all outbound connections, but that can be bypassed using other OLEDB providers. Cesar. --- Michael - <michael () nix org> wrote:
After reading your papers I must say it was quite interesting and it introduce quite a few new ideas. However, most of them (at leat in your paper found at
http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf
) base themselves on the idea that you can perform an 'insert' with SQL injection. In my experience, this is impossible most of the time due to the fact that MSSQL doesnt allow multiple statement and that you can only add an union in the middle of an SQL statement that is usualy part of a web application. Michael _______________________________________________ Full-Disclosure - We believe in it. Charter:
http://lists.netsys.com/full-disclosure-charter.html __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Latest MS SQL Server vulnerabilities revealed. Cesar (Apr 30)
- <Possible follow-ups>
- Re: Latest MS SQL Server vulnerabilities revealed. Michael - (Apr 30)