Home page logo

bugtraq logo Bugtraq mailing list archives

re:Latest MS SQL Server vulnerabilities revealed
From: "Michael -" <michael () nix org>
Date: 30 Apr 2003 16:04:05 -0000

 After reading your papers I must say it was quite interesting and it introduce quite a few new ideas. However, most of 
them (at leat in your paper found at 
http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf ) base themselves on the idea 
that you can perform an 'insert' with SQL injection. In my experience, this is impossible most of the time due to the 
fact that MSSQL doesnt allow multiple statement and that you can only add an union in the middle of an SQL statement 
that is usualy part of a web application.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]