From: Andres Molinetti (andymolinetti@hotmail.com)
Date: Mon Feb 21 2005 - 14:17:45 EST
I have already posted this a few days ago, but this time I have gattered
more information and I think this would be a bit less fuzzy than the
previous one:
I'm pen-testing an web app with a DB2 database.
I have found it is vulnerable to SQL Injection, but I'm having some problems
in performing an UNION query to get data from other tables.
I suppouse the original query is like this: SELECT Cod,Desc FROM TB1 WHERE
Desc='
(if I append: ' OR 1=1-- I get all rows returned)
so I have appended this string: ' UNION ALL SELECT 'A', 'A' FROM SYSTABLES
-- Table TB1 has the following structure: . Cod (char) . Desc (char) . FH (timestmp) . Upd (char) so...selecting 'A','A' should match column types.... anyway I still getting " UNION operands are not compatible" any ideas? Thanks in advance, Andy _________________________________________________________________ Descarga gratis la Barra de Herramientas de MSN http://www.msn.es/usuario/busqueda/barra?XAPID=2031&DI=1055&SU=http%3A//www.hotmail.com&HL=LINKTAG1OPENINGTEXT_MSNBH
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:17 EDT