Re: Cold Fusion and Sql Injection

morning_wood wrote:
> mby some help at

I fail to see how your pointer (to an exploitation of a XSS vulnerability in Coldfusion using iframes?) relates to the original question (SQL injection + Cold Fusion).

Answering George, I would suggest that this is _not_ an error of Cold Fusion input validation but of a stored procedure being used in the SQL server. Probably, the cold fusion engine just calls an procedure in the SQL server with the input as parameters and the code in there is the one trying to do the conversion.

Notice that you are only seeing ODBC-SQL server errors, no errors code from Cold Fusion there so it looks like Cold Fusion is passing things blindly.

Regards

Javi

You're a pen tester, but is google.com still your R&D team? Now you can get trustworthy commercial-grade exploits and the latest techniques from a world-class research group.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Visit us at: www.coresecurity.com/promos/sf_ept1 or call 617-399-6980