Re: Oracle 9i Union Flaw

[Brandon Petty <bmpfg8 () umr edu>]

In-Reply-To: <20040930224011.21783.qmail () www securityfocus com>

> A fellow student, here at UMR, has tested the MSAccess 2K/XP Union Flaw 

If you are wondering about the Access Union Flaw... I posted something that was, for the most part, incorrect about 
Access and how it handles Unions.  There are a few quirks... but nothing that should have been posted.  Mainly, my bad.

I still think that if you are going to union two fields... that the results should not be stored under one of those 
fields headings if they are different.  Like doing a union on Login and Password.  It would be best to return the 
results under something like LoginKey instead of Login.  That way if I do an SQL Injection by using the ever popular 
Union operator... I know that I am not going to return other data if I print out the contents of the Login results.  
This of course would have to be done by the dbs.

The issue with Oracle 9i not allowing you to miss match more than two fields is still strange.  I don't remember what 
the exact errors where.  This could be a flaw in Oracle... but I have not looked into this.  I wouldn't think it would 
matter how many differing fields you union on.  But then again... I really haven't look into Oracle to say too much.