RE: Oracle SQL Injection vulnerability

Hey Paul, thanks for that. But the given link doesn't
work.

Does anyone have an offline copy by chance? If yes,
can you bother to send me?

Thanks.

--- Paul Melson <pmelson@xxxxxxxxx> wrote:

Does that mean the site is vulnerable to SQL
Injection? I tried ' OR 1=1--
and ' OR '1'='1'--
but I get same error message.

Yes, and as it stands, this is definitely a finding
for your client
regardless of whether or not you are able to exploit
it. But of course, you
want to exploit it both to make a credible argument
to your client as well
as to feel cool.

I recommend Mavituna's Oracle SQL Injection Cheat
***:


http://ferruh.mavituna.com/makale/oracle-sql-injection-cheat-***/

PaulM




------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE
today!

http://www.cenzic.com/downloads

------------------------------------------------------------------------





Bring your gang together - do your thing. Go to http://in.promos.yahoo.com/groups


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------