Lateral SQL Injection: A New Class of Vulnerability in Oracle (2008)

 

 

How can an attacker exploit a PL/SQL procedure that doesn’t even take user input? Or how does one do SQL injection using DATE or even NUMBER data types? In the past this has not been possible but as this paper will demonstrate, with a little bit of trickery, you can in the Oracle RDBMS. Consider the following code for a PL/SQL procedure ... It takes no parameters and so typically would not be audited. That said, we can see that the V_DATE variable is embedded within an SQL query which is then dynamically executed via the EXECUTE IMMEDIATE statement. Tracing back through the code we see that value for V_DATE is assigned from a call to the SYSDATE() built in function. If this were somehow influenceable then an attacker could potentially inject arbitrary SQL. As we will see this is fully exploitable but first let's consider this code: [via]
http://www.databasesecurity.com/dbsec/lateral...

Rating: 0/10

 

Download File

 

Tags: Tag sql injection, Tag sql, Tag injection, Tag vulnerability, Tag security, Tag oracle, ...

 

Related Files

 

 
Sponsored Links
Free Download Sonos Manual, Guide, Instructions, available in PDF ebooks format.
Lateral SQL Injection: A New Class of Vulnerability in Oracle

Rate this Document

Popular eBooks

ADS

 

Tag Clouds

3d  algorithm  analysis  application  architecture  design  ebook  energy  framework  guide  java  javascript  kernel  linux  manual  network  paper  programming  python  reference  security  software  system  theory  thesis  tutorial  typography  web service  white paper  xml 

 

Last Download

 

BookShelf