[Full-disclosure] SQID v0.2 - SQL Injection Digger.

[icecoldeuro at gmail.com]

So - hypothetically - the first result of the sample run at
sqid.rubyforge.org would only yield a Microsoft OLE DB provider error (Unclosed
quotation mark before the character string).

Now, granted, this is bad practice if they can't trap their errors, but I
also don't see how this constitutes proof of an XSS vulnerability. The usual
XSS variations - again, purely hypothetically - all just yield the same
error message.

Would you consider this a potential false positive then? In my opinion it's
not a vuln unless it's exploitable.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20061226/ea833e5d/attachment.html