Date: 30 Sep 2004 22:40:11 -0000
From: Brandon Petty <[email protected]>
To: [email protected]Subject: Oracle 9i Union Flaw
A fellow student, here at UMR, has tested the MSAccess 2K/XP Union Flaw on Oracle 9i.
His name is Muthukumar Narayanan: [email protected] .
He found that Oracle 9i has the same problem as Access... but it is a little different.
He found that you can select up to 2 miss ordered columns for the results to be mixed.
An example:
select login, password from flaw union select password, login from flaw;
select login from flaw union select password from flaw;
It seems that if you do more than 2, it will return an error. Also, in the last case... this is a prime example of something that an SQL Injection attack could really take advantage of. Again, you are asking for the login name... but are returned password data. What happens when a Server Side Script tries to print out all of the login names since it is pointed at the login field? hmmm...
You can contact him for more information on the Oracle 9i issue.
I would also suspect MySQL and Postgresql to have something similar since this seems
to be an issue with more than one database server. This has not been tested.
Note: Oracle has not been contacted. This was brought to my attention 15 minutes ago after we had discussed the flaw I found in Access.
Thanks,
Brandon P.
