full-disclosure - Latest MS SQL Server vulnerabilities revealed.

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [month] [year] [list]

From: cesarc56 at yahoo.com (Cesar)
Subject: Latest MS SQL Server vulnerabilities revealed.  

MS SQL Server DOES allow multiple statements, you
should be confused with mysql. The ideas presented in
paper work most of the time on web applications
vulnerable to SQL injection, the only problem is when
firewalls block all outbound connections, but that can
be bypassed using other OLEDB providers.

Cesar.

--- Michael - <michael@....org> wrote:
> 
> After reading your papers I must say it was quite
> interesting and it introduce quite a few new ideas.
> However, most of them (at leat in your paper found
> at
>
http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf
> ) base themselves on the idea that you can perform
> an 'insert' with SQL injection. In my experience,
> this is impossible most of the time due to the fact
> that MSSQL doesnt allow multiple statement and that
> you can only add an union in the middle of an SQL
> statement that is usualy part of a web application. 
> 
> Michael 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter:
http://lists.netsys.com/full-disclosure-charter.html

__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com