1

The backend server is running Tomcat 8.5 (Java backend). The URL in question is:

https://website.com/application/servlet.do?currentOID=abc12300000000

I found that when I give an incomplete OID (i.e 1 char remove), or I add a char (i.e a or '), the server throws an error:

org.apache.ojb.broker.PersistenceBrokerSQLException: SQL failure while insert object data for class com.abc, PK of the given object is [ oid=CBA000000AAAAA], object was GroupPageTab CBA000000AAAAA, exception message is [String or binary data would be truncated.]
    at org.apache.ojb.broker.accesslayer.JdbcAccessImpl.executeInsert(JdbcAccessImpl.java:243)
    at org.apache.ojb.broker.core.PersistenceBrokerImpl.storeToDb(PersistenceBrokerImpl.java:1642)
    at org.apache.ojb.broker.core.PersistenceBrokerImpl.store(PersistenceBrokerImpl.java:1557)
    at org.apache.ojb.broker.core.PersistenceBrokerImpl.store(PersistenceBrokerImpl.java:1506)
    ...

and the OID CBA000000AAAAA, changes when currentOID is changed. Does this look like it may be vulnerable to injection? I'm inexperienced in JDBC so I am unsure.

Improve this question

1 Answer 1

Reset to default
4

No, the error does not indicate SQL injection.

String or binary data would be truncated.

This means that the data you try to insert is too big for the column. If the column is of type CHAR(10), you can store 10 bytes in it. If you try to store 20 bytes in it, you get this error. This can happen even if the data is correctly handled and the page is not vulnerable to SQL injection.

Improve this answer
1
  • Interesting, but if I give it 9 bytes same error. Does CHAR(10) not permit lower than 10 bytes? Thanks.
    – Rob Gates
    Commented Aug 30, 2018 at 14:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .