Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Pen-Test
[Top] [All Lists]

Re: Oracle URL SQL Injection issue

Subject: Re: Oracle URL SQL Injection issue
Date: Tue, 22 Jan 2008 22:22:35 +0100
Hi,

On lun, 2008-01-21 at 20:31 +0000, Clone wrote:

Well I already tried 

Id=90; select * from usr
I got following

OCIStmtExecute: ORA-00911: invalid character in
dbs.inc on line 44

OCIStmtExecute refuses to execute more than one command except when the
programmer uses a construction like:

begin
  proc('user_controlled_data');
end;


BTW how serious is the issue? Can an attacker delete
or modify database using the current issue? 

It depends in the privileges the user have and in which applications are
installed. First of all, you need to know the database version (banner
-varchar2- from v$version), what other users are (all_users) and, of
course, your roles (user_role_privs views) and granted system privileges
(user_privs).

Regards,
Joxean Koret

Attachment: signature.asc
Description: This is a digitally signed message part

<Prev in Thread] Current Thread [Next in Thread>