Browse by Tags

All Tags » Security (RSS)
Lateral SQL injection in Oracle
David Litchfield has just released a paper, showing that it is possible to do SQL injection using DATE or even NUMBER data types to exploit a PL/SQL procedure in Oracle RDBMS! The attacker can exploit a PL/SQL procedure that doesn't even take user...
Posted 28 April 2008 02:41 PM by Martin Poon | with no comments
Filed under: ,
Enabling xp_cmdshell in SQL Server 2005
xp_cmdshell is used to spawn a Windows command shell and executes a command line process by the operating system. In order to minimize the security risk of executing malicious code outside SQL Server 2005, xp_cmdshell is disabled by default, and the following...
Posted 03 October 2006 08:33 PM by Martin Poon | with no comments
Filed under: , ,
SQL Server service pack installation may save the system administrator password in a file for SQL Server 7.0 and SQL Server 2000
During the installation of SQL Server products and service packs, the password(s) of system administrator (sa) and/or SQL Server Sevices domain account may be stored as clear text or weakly encrypted readable format in the SQL Server Setup files and/or...
Posted 18 September 2006 09:45 PM by Martin Poon | with no comments
Filed under: ,