Re: Oracle SQL Injection

[Esteban Martinez Fayo <secemf () yahoo com ar>]

Mark,

This seems to be a SQL Injection vulnerability in a
SELECT statement. You will not be able to inject DDL
statements or UPDATE/INSERT/DELETEs. What you can do
is inject a function call inside the SELECT statement.

If you have access to the Oracle server and you can
create a function, you will be able to execute it
using the SQL Injection with elevated privileges.
If you do not have access to the Oracle server, you
will need to use one of the many Oracle functions
vulnerable to buffer overflow or SQL Injection.

You can see my last year BlackHat presentation for
examples.
You can download it from
http://www.argeniss.com/research/OracleSQLInjBHUSA05.zip
I think the examples in slides 27 and 34 can be
applied in your situation.

Esteban.



--- Mark Keegan <mark.keegan () paradise net nz> wrote:

> Hi Group, I am performing my first web assessment on
> a web application with
> an Oracle backend.  Now I need to say that my
> background is solidly in the
> MS space and Oracle is a new beast to me.  I have
> discovered that the
> application is open to SQL injection and while I can
> perform the typical
> UNION queries to harvest information from other
> tables I am failing to
> execute other statements such as INSERT, DELETES or
> DROPs.  In MSSQL I can
> use a Semicolon ; to append these types of
> statements as follows:
>  
> ;UPDATE sometable SET column x = 'blah'--
>  
> It appears that Oracle does not like this type of
> syntax where we are
> appending an UPDATE onto an existing SELECT
> statement.  Could someone please
> point me in the right direction on how to execute
> these type of commands.  
>  
> I should also say that the application appears to be
> replacing a semicolon
> with a coma.
>  
> Many Thanks
> Mark
>  
>  
-------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> Cross-Site Scripting (XSS) is one of the most common
> application-level 
> attacks that hackers use to sneak into web
> applications today. This 
> whitepaper will discuss how traditional CSS attacks
> are performed, how to 
> secure your site against these attacks and check if
> your site is protected. 
> Cross-Site Scripting Explained - Download this
> whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr
>
--------------------------------------------------------------------------
>


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

-------------------------------------------------------------------------
Sponsored by: Watchfire

Cross-Site Scripting (XSS) is one of the most common application-level 
attacks that hackers use to sneak into web applications today. This 
whitepaper will discuss how traditional CSS attacks are performed, how to 
secure your site against these attacks and check if your site is protected. 
Cross-Site Scripting Explained - Download this whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr
--------------------------------------------------------------------------