Re: sql injection with MS Access

From: Kevin Spett (kspett@spidynamics.com)
Date: 11/29/01 

Message-ID: <001301c17877$9f130630$0901010a@spidata>
From: "Kevin Spett" <kspett@spidynamics.com>
To: "helmut schmidt" <helmutsch69@hotmail.com>, <pen-test@securityfocus.com>
Subject: Re: sql injection with MS Access
Date: Wed, 28 Nov 2001 17:46:09 -0800

> I am currently testing SQL injection with a web application and MS Access
> database. I have some difficulties as I do not knowing the comment
character
> for Access Database.

    I'm afraid that you're out of luck. There is no magical -- character to
work with in MS Access like SQL Server. You'll have to get around the
syntax error the hard way. Try sending these strings as parameters to fish
out as much of the sql query as possible:

'
badvalue'
'badvalue
badvalue, badvalue
' OR

Also, here're the MS Access system tables, which you hopefully will have
priveleges to read:
MSysACEs
MSysObjects
MSysQueries
MSysRelationships

Good luck.

Kevin Spett
Resident SQL Injection Ninja
SPI Dynamics, Inc.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • sql injection with MS Access
    ... I am currently testing SQL injection with a web application and MS Access ... for Access Database. ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: sql injection with MS Access
    ... Can someone confirm that SQL injection is feasible with MS ... The following would be sent to the database: ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: submitted data not updated promptly with ms access
    ... therefore, before writing to the database, i ... using sql injection ... Using an expensive recordset to run a query that does not retrieve ... is what I suspect you want to do, although I don't really know why you wish ...
    (microsoft.public.inetserver.asp.db)
  • Re: Executing PHP files on remote web server
    ... The syntax may be different between programming languages and database engines, but the concept of avoiding SQL injections isn't that different. ... SQL injection from a DBA's perspective is completely different from that of a programmer. ... Quite frankly, while you have good experience in database administration and Unix administration, I see virtually nothing in this which provides the necessary experience for programming. ...
    (comp.lang.php)
  • RE: SQL injection from within a table - is it possible?
    ... I would assume that all parsers would parse the /entire/ sql query ... Suppose your username was "bob", ... Going back to your initial question about a "stored" SQL Injection ... Is it possible to store an SQL injection string into a MSSQL database ...
    (Pen-Test)