R: [Full-Disclosure] sql injection question

From: Manuel [ekerazha] (ekerazha_at_yahoo.it)
Date: 10/15/03

  • Next message: Lorenzo Hernandez Garcia-Hierro: "[Full-Disclosure] Supposed SaS "encryption" weak - Coments and Infor about wrong claims" 
    To: <full-disclosure@lists.netsys.com>
Date: Wed, 15 Oct 2003 18:48:00 +0200

    Yeah... you are vulnerable to sql-injection.
    You have to replace the single quotes with two quotes in the postdata
    received from the search form.

    ASP Ex: Replace(Request.Querystring("SOMETHING"), "'", "' '")

    Byeee ;-)

    P.S.
    Excuse me for my english :S

    -----Messaggio originale-----
    Da: full-disclosure-admin@lists.netsys.com
    [mailto:full-disclosure-admin@lists.netsys.com] Per conto di Richard Stevens
    Inviato: mercoledì 15 ottobre 2003 17.58
    A: full-disclosure@lists.netsys.com
    Cc: David Rees
    Oggetto: [Full-Disclosure] sql injection question

    Quick question for the list, if I may,

    We have a third party application that we are piloting for using as web
    store front end.

    I have no idea on programming sql at all, but have read of some of the sql
    injection techniques on this list.

    In the search box on the app, by inserting ' followed by a space, the
    following message is generated:

    ---------------------------------------------------------------------------- 

    ----
Technical Information (for support personnel)
Error Type:
Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)
[Microsoft][ODBC SQL Server Driver][SQL Server]Line 1: Incorrect syntax near
' insert into @promtable select a.ItemCode, a.SysNumber, a.TechDescription,
a.InvoiceDescription, a.Classification, a.ProductGrou'.
/eshop/search.asp, line 265
Browser Type:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) 
Page:
GET
/eshop/search.asp?SessionId=PR10006210200315411635Q3TLJ310ELW679PQ7Y&QuickSe
arch=%27+ 
Time:
Wednesday, October 15, 2003, 4:45:30 PM 
Also, the password for SA is stored in clear text in the site in a text
config file. This would not strike me as being sensible.
These are both ringing alarm bells !
From this info, would you assume it would be easy for someone skilled in sql
injection to get unauthorised access to the database?.. or is it not that
simple?
The input seems to be filtered correctly on the logon.asp, as entering these
characters has no apparent effect.
TIA
Richard
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Lorenzo Hernandez Garcia-Hierro: "[Full-Disclosure] Supposed SaS "encryption" weak - Coments and Infor about wrong claims"

    Relevant Pages

    • Re: Handling Strings in SQL server
      ... About injection you are right but the string was 'O' and all this quoted so ... But if just old plain SQL Server stored procedures is the most common ... two single quotes this does not address the real problem. ... A real solution is to pass your string arguments to your SQL queries in ADO ...
      (microsoft.public.dotnet.framework.adonet)
    • Official release of SQL Power Injector 1.2
      ... One of the major improvements is an innovative way to optimize and accelerate the dichotomy in the Blind SQL injection, saving time/number of requests up to 25%. ... Also another great time saver is a new Firefox plugin that will launch SQL Power Injector with all the information of the current webpage with its session context. ... No more time wasted to copy paste the session cookies after you logged... ...
      (Bugtraq)
    • Official release of SQL Power Injector 1.2
      ... One of the major improvements is an innovative way to optimize and accelerate the dichotomy in the Blind SQL injection, saving time/number of requests up to 25%. ... Also another great time saver is a new Firefox plugin that will launch SQL Power Injector with all the information of the current webpage with its session context. ... No more time wasted to copy paste the session cookies after you logged... ...
      (Pen-Test)
    • Official release of SQL Power Injector 1.2
      ... One of the major improvements is an innovative way to optimize and accelerate the dichotomy in the Blind SQL injection, saving time/number of requests up to 25%. ... Also another great time saver is a new Firefox plugin that will launch SQL Power Injector with all the information of the current webpage with its session context. ... No more time wasted to copy paste the session cookies after you logged... ...
      (Security-Basics)
    • [Full-disclosure] OTRS 1.x/2.x Multiple Security Issues
      ... OTRS, the Open Source Ticket Request System, is a trouble ... ranging from cross site scripting to SQL injection. ... A malicious user may be able to conduct blind SQL code ... an attacker may be able to exploit this issue. ...
      (Full-Disclosure)