full-disclosure - Informix SQL injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <b64889370702050940h3b62b631u7e453ced74311a81@mail.gmail.com>
Date: Mon, 5 Feb 2007 14:40:51 -0300
From: "Joshua Tagnore" <joshua.tagnore@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Informix SQL injection

List,

    I'm doing a pentest on a website that uses informix web datablade and
found a sql injection point. I have been able to use the webexplode() stored
procedure to execute any SQL commands, and also operating system commands
using SYSTEM. The problem I have is that SYSTEM doesnt return the execution
result(its a procedure, not a function), so I have to save them to a file;
for example : SYSTEM 'ls /etc/ > /tmp/result' and then read that file... the
problem is... how do i read that file ? I have tried with "load from ..."
and it fails with a sintax error, and on the other side, when I use
FILETOCLOB('/tmp/result','server') i dont know how to get the contents of
the CLOB... anyone knows something informix ?

Cheers,

-- 
Joshua Tagnore

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/