1

The backend server is running Tomcat 8.5 (Java backend). The URL in question is:

https://website.com/application/servlet.do?currentOID=abc12300000000

I found that when I give an incomplete OID (i.e 1 char remove), or I add a char (i.e a or '), the server throws an error:

org.apache.ojb.broker.PersistenceBrokerSQLException: SQL failure while insert object data for class com.abc, PK of the given object is [ oid=CBA000000AAAAA], object was GroupPageTab CBA000000AAAAA, exception message is [String or binary data would be truncated.]
    at org.apache.ojb.broker.accesslayer.JdbcAccessImpl.executeInsert(JdbcAccessImpl.java:243)
    at org.apache.ojb.broker.core.PersistenceBrokerImpl.storeToDb(PersistenceBrokerImpl.java:1642)
    at org.apache.ojb.broker.core.PersistenceBrokerImpl.store(PersistenceBrokerImpl.java:1557)
    at org.apache.ojb.broker.core.PersistenceBrokerImpl.store(PersistenceBrokerImpl.java:1506)
    ...

and the OID CBA000000AAAAA, changes when currentOID is changed. Does this look like it may be vulnerable to injection? I'm inexperienced in JDBC so I am unsure.

4

No, the error does not indicate SQL injection.

String or binary data would be truncated.

This means that the data you try to insert is too big for the column. If the column is of type CHAR(10), you can store 10 bytes in it. If you try to store 20 bytes in it, you get this error. This can happen even if the data is correctly handled and the page is not vulnerable to SQL injection.

  • Interesting, but if I give it 9 bytes same error. Does CHAR(10) not permit lower than 10 bytes? Thanks. – Rob Gates Aug 30 '18 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.