Penetration Testing mailing list archives
RE: Oracle SQL Injection vulnerability
From: "Paul Melson" <pmelson () gmail com>
Date: Mon, 19 Nov 2007 16:22:51 -0500
Does that mean the site is vulnerable to SQL Injection? I tried ' OR 1=1--
and ' OR '1'='1'--
but I get same error message.
Yes, and as it stands, this is definitely a finding for your client regardless of whether or not you are able to exploit it. But of course, you want to exploit it both to make a credible argument to your client as well as to feel cool. I recommend Mavituna's Oracle SQL Injection Cheat Sheet: http://ferruh.mavituna.com/makale/oracle-sql-injection-cheat-sheet/ PaulM ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Oracle SQL Injection vulnerability Attari Attari (Nov 19)
- Re: Oracle SQL Injection vulnerability Steven Adair (Nov 19)
- Re: Oracle SQL Injection vulnerability Joxean Koret (Nov 19)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- RE: Oracle SQL Injection vulnerability Erin Carroll (Nov 19)
- RE: Oracle SQL Injection vulnerability Paul Melson (Nov 19)
- RE: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- Re: Oracle SQL Injection vulnerability Zed Qyves (Nov 24)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- Re: Oracle SQL Injection vulnerability Zed Qyves (Nov 24)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- <Possible follow-ups>
- RE: Oracle SQL Injection vulnerability David Cullen (Nov 24)
- Re: RE: Oracle SQL Injection vulnerability eladexposed (Nov 25)