ColdFusion and Oracle SQL Injection Example -

assuming coldfusion 10,0,13,287689 , oracle database 11g enterprise edition release 11.2.0.2.0 - 64bit production.

with example...

<cfquery name="q" datasource="ds">     update sometable set     #form.col#label = <cfqueryparam cfsqltype="cf_sql_varchar" value="#x#">     id = <cfqueryparam cfsqltype="cf_sql_decimal" value="#id#"> </cfquery> 

also assuming there no data validation checking on #form.col#, how exploited? cause query fail invalid column, don't see way more malicious done since multiple statements cannot ran in single <cfquery>. not work...

#form.col#:

id = 1; delete users; --comment else out... 

i'm aware selects it's easier exploit using unions data you're not authorized see, i'm curious specific update statement.

whilst traditional example sql injection involves sequential sql statements, simple example used highlight issue - if unprotected user-derived text allowed anywhere in query there's chance attacker able make use of it.

in specific example, query is:

update sometable set #form.col#label = ? id = ?` 

to abuse simple - prefix genuine col value like:

public_column = (select badly_encrypted_password  users username='admin' ), <orig_value> 

the resultant sql then:

update sometable set public_column = ( select badly_encrypted_password users username='admin' )   , <orig_value>label = ? id = ?` 

which of course sets value of column result of sub-query, , separate select in area innocently return sensitive data.

alternatively, attacker may decide deface/remove data using method, , depending on precisely oracle's sql syntax allows, other things might possible.