('binary' encoding is not supported, stored as-is)
In-Reply-To: <20040930224011.21783.qmail_at_www.securityfocus.com>
>A fellow student, here at UMR, has tested the MSAccess 2K/XP Union Flaw
If you are wondering about the Access Union Flaw... I posted something that was, for the most part, incorrect about Access and how it handles Unions. There are a few quirks... but nothing that should have been posted. Mainly, my bad.
I still think that if you are going to union two fields... that the results should not be stored under one of those fields headings if they are different. Like doing a union on Login and Password. It would be best to return the results under something like LoginKey instead of Login. That way if I do an SQL Injection by using the ever popular Union operator... I know that I am not going to return other data if I print out the contents of the Login results. This of course would have to be done by the dbs.
The issue with Oracle 9i not allowing you to miss match more than two fields is still strange. I don't remember what the exact errors where. This could be a flaw in Oracle... but I have not looked into this. I wouldn't think it would matter how many differing fields you union on. But then again... I really haven't look into Oracle to say too much.
Received on Oct 02 2004
Intro
