SQL Insertion

From: alex@geoquark.com
Date: 04/09/02 

Date: Tue, 9 Apr 2002 09:48:34 +0100 (BST)
From: <alex@geoquark.com>
To: <pen-test@securityfocus.com>

From the following:
vulnerable.asp?g=1;

Error Type:
Microsoft OLE DB Provider for ODBC Drivers
(0x80040E14)
[Microsoft][ODBC SQL Server Driver][SQL
Server]Incorrect syntax near the keyword 'order'.

you can assume that the sql statement is of the form: (nice and generic)

select A from B where C order by D

you are inseting into C in this example. what you need to do is provide
something like:

g=1; select * from sysobjects--

note the single line comment at the end (--), this is necessary to prevent
the "order" clause being executed out of context in our inserted query.

There were some good papers on this... can only remember
www.ngssoftware.com off the top of my head.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • Re: faster scans? (nmap)
    ... one host using nmap for syn scans in burst mode with the ... >>>This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: pen test help please asap
    ... > Machine A on client site makes a configurable encrypted OUTBOUND ... > This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • Re: ettercap help
    ... Anyways have never tried Ettercap for VNC. ... > This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • RE: CFM SQL injection
    ... You should better use union or alike get unauthorized data from the ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: ettercap help
    ... > I can get it to sniff telnet, ftp, pop, smb, but no vnc. ... > This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)