DB2 - SQL Injection

From: Andres Molinetti (andymolinetti@hotmail.com)
Date: Mon Feb 21 2005 - 14:17:45 EST


I have already posted this a few days ago, but this time I have gattered
more information and I think this would be a bit less fuzzy than the
previous one:

I'm pen-testing an web app with a DB2 database.

I have found it is vulnerable to SQL Injection, but I'm having some problems
in performing an UNION query to get data from other tables.

I suppouse the original query is like this: SELECT Cod,Desc FROM TB1 WHERE
Desc='
(if I append: ' OR 1=1-- I get all rows returned)
so I have appended this string: ' UNION ALL SELECT 'A', 'A' FROM SYSTABLES

--
Table TB1 has the following structure:
. Cod (char)
. Desc (char)
. FH (timestmp)
. Upd (char)
so...selecting 'A','A' should match column types....
anyway I still getting " UNION operands are not compatible"
any ideas?
Thanks in advance, Andy
_________________________________________________________________
Descarga gratis la Barra de Herramientas de MSN 
http://www.msn.es/usuario/busqueda/barra?XAPID=2031&DI=1055&SU=http%3A//www.hotmail.com&HL=LINKTAG1OPENINGTEXT_MSNBH


This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:17 EDT