Penetration Testing: Re: JET sql help please anyone

["Tom Vandepoel" <tom.vandepoel () be ubizen com>]

Gary O'leary-Steele wrote:


> various other errors occurred during the test such as
>
> Microsoft JET Database Engine error '80040e14'
> Invalid SQL statement; expected 'DELETE', 'INSERT', 'PROCEDURE', 'SELECT',
> or 'UPDATE'.

Ran into this myself a while ago.

The reason you can't invoke shell() is probably because it's running in sandbox 
mode, which I think is the default in more recent versions. Tough luck.
See: http://support.microsoft.com/default.aspx?scid=kb;EN-US;q239482

Tom.






----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/