DB2 - SQL Injection

From: Andres Molinetti (andymolinetti_at_hotmail.com)
Date: 02/21/05

  • Next message: Frank Knobbe: "Re: Bypassing NTFS ACL" 
    To: pen-test@securityfocus.com
Date: Mon, 21 Feb 2005 19:17:45 +0000

    I have already posted this a few days ago, but this time I have gattered
    more information and I think this would be a bit less fuzzy than the
    previous one:

    I'm pen-testing an web app with a DB2 database.

    I have found it is vulnerable to SQL Injection, but I'm having some problems
    in performing an UNION query to get data from other tables.

    I suppouse the original query is like this: SELECT Cod,Desc FROM TB1 WHERE
    Desc='
    (if I append: ' OR 1=1-- I get all rows returned)
    so I have appended this string: ' UNION ALL SELECT 'A', 'A' FROM SYSTABLES 

    --
Table TB1 has the following structure:
. Cod (char)
. Desc (char)
. FH (timestmp)
. Upd (char)
so...selecting 'A','A' should match column types....
anyway I still getting " UNION operands are not compatible"
any ideas?
Thanks in advance, Andy
_________________________________________________________________
Descarga gratis la Barra de Herramientas de MSN 
http://www.msn.es/usuario/busqueda/barra?XAPID=2031&DI=1055&SU=http%3A//www.hotmail.com&HL=LINKTAG1OPENINGTEXT_MSNBH
  • Next message: Frank Knobbe: "Re: Bypassing NTFS ACL"

    Relevant Pages

    • Re: creteria macros
      ... Having written the Union Query, if you have control over the Tables, I suggest basing a Make-Table Query on the Union Query and creating a Table containing all the records from the separate Tables. ... Class1_ID STATUSFIELD DATEFIELD ... So let's enter the new creteria once for Date and Status field and have it forwarded to each of the queries for CLASS1 through to CLASS8. ...
      (microsoft.public.access.queries)
    • Re: Union Query
      ... I definitely understand you comment about normalization. ... What happens with the "union" table is that it get's linked to ... here's the essentials of how to build a Union query. ... Each SELECT subquery may have other clauses (eg. ...
      (microsoft.public.access.queries)
    • Re: Union Query
      ... here's the essentials of how to build a Union query. ... FROM Table2 ... Each SELECT subquery may have other clauses (eg. ...
      (microsoft.public.access.queries)
    • Re: Sum Report
      ... I would specify the actual field names in the first UNION query you ... I would not include joining to tblName until after the UNION query has been ... > FROM tblName INNER JOIN tblTRAdmin ON tblName.NameID = ... >>>> tblName: NameID, Names, TRDate ...
      (microsoft.public.access.reports)
    • Re: Union Query
      ... if the first SELECT subquery has fields ... if you attempt to union a datetime field ... I definitely understand you comment about normalization. ... here's the essentials of how to build a Union query. ...
      (microsoft.public.access.queries)