Penetration Testing mailing list archives
RE: Oracle SQL Injection vulnerability
From: "Erin Carroll" <amoeba () amoebazone com>
Date: Mon, 19 Nov 2007 09:17:17 -0800
Yes. The application isn't escaping special characters in the input field and is executing the input as a statement. Try a username of %' or a name like 'admin% and see what you get back. If you're lucky you'll get an error message but the following statement will be executed "select id, user_role from users where name='%' OR NAME LIKE 'ADMIN%' Ïnjecting SQL commands without having a valid user account is a pretty severe issue and you should suggest to your client to set explicit input parameters (A-z, 0-9) and escape special characters using whichever method applies to their codebase. You can leverage several tools out there to test further. Off the top of my head there's SQLNinja, Absinthe, FJ-Injector Framework, NGSS SQL Injector, and many others. I'm sure others on the list will have some other suggestion or tips, this was just a quick response off the cuff. -- Erin Carroll Moderator SecurityFocus pen-test list "Do Not Taunt Happy-Fun Ball"
-----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Attari Attari Sent: Monday, November 19, 2007 1:32 AM To: pen-test () securityfocus com Subject: Oracle SQL Injection vulnerability Hi Group, I'm doing a penetration test for a client on their web portal. When I give ' on the username field I was received with an error from the server: Unspecified error ORA-01756: quoted string not properly terminated Does that mean the site is vulnerable to SQL Injection? I tried ' OR 1=1-- and ' OR '1'='1'-- but I get same error message. Any help would be much appreciated. Clone Meet people who discuss and share your passions. Go to http://in.promos.yahoo.com/groups -------------------------------------------------------------- ---------- This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads -------------------------------------------------------------- ----------
------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Oracle SQL Injection vulnerability Attari Attari (Nov 19)
- Re: Oracle SQL Injection vulnerability Steven Adair (Nov 19)
- Re: Oracle SQL Injection vulnerability Joxean Koret (Nov 19)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- RE: Oracle SQL Injection vulnerability Erin Carroll (Nov 19)
- RE: Oracle SQL Injection vulnerability Paul Melson (Nov 19)
- RE: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- Re: Oracle SQL Injection vulnerability Zed Qyves (Nov 24)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- Re: Oracle SQL Injection vulnerability Zed Qyves (Nov 24)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- <Possible follow-ups>
- RE: Oracle SQL Injection vulnerability David Cullen (Nov 24)
- Re: RE: Oracle SQL Injection vulnerability eladexposed (Nov 25)