|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
re:Latest MS SQL Server vulnerabilities revealed
From: Michael - (michael
nix.org)
Date: Wed Apr 30 2003 - 11:04:05 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
After reading your papers I must say it was quite interesting and it introduce quite a few new ideas. However, most of them (at leat in your paper found at http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf ) base themselves on the idea that you can perform an 'insert' with SQL injection. In my experience, this is impossible most of the time due to the fact that MSSQL doesnt allow multiple statement and that you can only add an union in the middle of an SQL statement that is usualy part of a web application.
Michael
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]