WebApp Sec mailing list archives
RE: ODBC Injection
From: "Lepore, Brian" <Brian.Lepore () marconi com>
Date: Wed, 30 Nov 2005 08:19:41 -0500
Hi John, Without knowing much about what's going on with your situation, I have two thoughts. Are you sure that 'idProduct' isn't set to an incompatible data type (i.e. INT)? Have you tried single ticks around 'test'? Brian Lepore Marconi Systems Engineer -----Original Message----- From: John Cobb [mailto:johnc () nobytes com] Sent: Wednesday, November 30, 2005 6:39 AM To: webappsec () securityfocus com Subject: ODBC Injection Hello All, I'm testing an ecommerce app on IIS6 with an M$ Access Database and I have found some injection: http://test.com/test.asp?sIdProduct=1 I get the following error when I insert alpha characters rather than numbers. I cannot manipulate this much, does anybody have any suggestions? Eg: http://test.com/test.asp?sIdProduct=test Database operations error: ODBC driver does not support the requested properties. SELECT * FROM Products WHERE idProduct = test ADODB.Recordset error '800a0e78' Operation is not allowed when the object is closed. /test.asp, line 135 Thanks John Cobb www.nobytes.com
Current thread:
- ODBC Injection John Cobb (Nov 30)
- Re: ODBC Injection John Bond (Nov 30)
- RE: ODBC Injection DAN MORRILL (Nov 30)
- RE: ODBC Injection Brett Moore (Nov 30)
- Re: ODBC Injection Maxime Ducharme (Nov 30)
- <Possible follow-ups>
- RE: ODBC Injection Lepore, Brian (Nov 30)
- RE: ODBC Injection LAROUCHE Francois (Dec 01)
- RE: ODBC Injection Auri Rahimzadeh (Dec 01)