Home page logo
/

bugtraq logo Bugtraq mailing list archives

re:Latest MS SQL Server vulnerabilities revealed
From: Cesar <cesarc56 () yahoo com>
Date: Thu, 1 May 2003 14:41:23 -0700 (PDT)


MS SQL Server DOES allow multiple statements, you
should be confused with mysql. The ideas presented in
paper work most of the time on web applications
vulnerable to SQL injection, the only problem is when
firewalls block all outbound connections, but that can
be bypassed using other OLEDB providers.

Cesar.

--- Michael - <michael () nix org> wrote:

 After reading your papers I must say it was quite
interesting and it introduce quite a few new ideas.
However, most of them (at leat in your paper found
at

http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf
) base themselves on the idea that you can perform
an 'insert' with SQL injection. In my experience,
this is impossible most of the time due to the fact
that MSSQL doesnt allow multiple statement and that
you can only add an union in the middle of an SQL
statement that is usualy part of a web application.

Michael
 


__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault