Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-disclosure] SQID v0.2 - SQL Injection Digger.
Date: Tue Dec 26 2006 - 18:28:57 CST
So - hypothetically - the first result of the sample run at
sqid.rubyforge.org would only yield a Microsoft OLE DB provider error (Unclosed
quotation mark before the character string).
Now, granted, this is bad practice if they can't trap their errors, but I
also don't see how this constitutes proof of an XSS vulnerability. The usual
XSS variations - again, purely hypothetically - all just yield the same
Would you consider this a potential false positive then? In my opinion it's
not a vuln unless it's exploitable.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/