I have a simple Stored Procedure:
create procedure [dbo].[test]
@str varchar (100)
AS
BEGIN
select * from [AdventureWorks2012].[HumanResources].[Employee] where JobTitle like '%' + @str +'%'
END
GO
Given this type of code, in what ways can I exploit it?
I've always been told that exploits of the sort of
exec test ''' ''; truncate table [AdventureWorks2012].[HumanResources].[Employee];--'
Should work, but now is the 1st time I got a chance to try it practically and it does not work.
The explanation I was given was that
''' ''; truncate table [AdventureWorks2012].[HumanResources].[Employee];--'
When concatenated with the query becomes
select * from [AdventureWorks2012].[HumanResources].[Employee] where JobTitle like '%' + ' ' ; truncate table [AdventureWorks2012].[HumanResources].[Employee];-- + '%'
So, the SELECT
query will execute with the jobtitle searching for any character followed by a space. The ;
terminates the where condition and then the truncate table statement executes. Where am I going wrong? I'm using Microsoft SQL server 2012.