full-disclosure - Latest MS SQL Server vulnerabilities revealed.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030430205424.6394.qmail@inbox.net>
From: michael at nix.org (Michael -)
Subject: Latest MS SQL Server vulnerabilities revealed.  

After reading your papers I must say it was quite interesting and it introduce quite a few new ideas. However, most of them (at leat in your paper found at http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf ) base themselves on the idea that you can perform an 'insert' with SQL injection. In my experience, this is impossible most of the time due to the fact that MSSQL doesnt allow multiple statement and that you can only add an union in the middle of an SQL statement that is usualy part of a web application. 

Michael