RE: ODBC Injection

["Lepore, Brian" <Brian.Lepore () marconi com>]

Hi John,

Without knowing much about what's going on with your situation, I have two
thoughts.  Are you sure that 'idProduct' isn't set to an incompatible data
type (i.e. INT)?  Have you tried single ticks around 'test'?

Brian Lepore
Marconi Systems Engineer

-----Original Message-----
From: John Cobb [mailto:johnc () nobytes com]
Sent: Wednesday, November 30, 2005 6:39 AM
To: webappsec () securityfocus com
Subject: ODBC Injection


Hello All,

I'm testing an ecommerce app on IIS6 with an M$ Access Database and I have
found some injection:

http://test.com/test.asp?sIdProduct=1

I get the following error when I insert alpha characters rather than
numbers.
I cannot manipulate this much, does anybody have any suggestions?

Eg:

http://test.com/test.asp?sIdProduct=test


Database operations error:

ODBC driver does not support the requested properties.

SELECT * FROM Products WHERE idProduct = test

ADODB.Recordset error '800a0e78'

Operation is not allowed when the object is closed.

/test.asp, line 135

Thanks

John Cobb
www.nobytes.com