Search code examples
oraclesql-injectionpenetration-testing

using an update query inside a select SQL injection (oracle)


I got an SQL injection point which allows me to insert anything after a Select keyword , such as :

Select ID FROM %INJECTION POINT%

is there anyway to complete this query to make an update for a table ? without using a ";" ?


Solution

  • It's not possible to do this in oracle , unless you use an existing user function to do so