Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: Oracle URL SQL Injection issue |
|---|---|
| Date: | Tue, 22 Jan 2008 22:22:35 +0100 |
Hi, On lun, 2008-01-21 at 20:31 +0000, Clone wrote:
Well I already tried Id=90; select * from usr I got following OCIStmtExecute: ORA-00911: invalid character in dbs.inc on line 44
OCIStmtExecute refuses to execute more than one command except when the
programmer uses a construction like:
begin
proc('user_controlled_data');
end;
BTW how serious is the issue? Can an attacker delete or modify database using the current issue?
It depends in the privileges the user have and in which applications are installed. First of all, you need to know the database version (banner -varchar2- from v$version), what other users are (all_users) and, of course, your roles (user_role_privs views) and granted system privileges (user_privs). Regards, Joxean Koret
signature.asc
Description: This is a digitally signed message part
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: Question re: load balancers as a security device, David Glosser |
|---|---|
| Next by Date: | Re: Question re: load balancers as a security device, kevin horvath |
| Previous by Thread: | Re: Oracle URL SQL Injection issue, Clone |
| Next by Thread: | Re: Oracle URL SQL Injection issue, Todd Manning |
| Indexes: | [Date] [Thread] [Top] [All Lists] |