I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error:

OraOLEDB error '80004005'

ORA-01756: quoted string not properly terminated

/student/wifi_grievance_submit.asp, line 54

This confirms that there is a SQL injection vulnerability, so I proceeded with the next steps; i.e. entering ' order by 100-- - to see the number of rows. But instead of getting the number of rows, I'm getting a different error.

OraOLEDB error '80040e14'

ORA-00917: missing comma

/student/wifi_grievance_submit.asp, line 54

Can anyone explain what this error means and how I can get the number of columns?

  • It's hard to tell because the full query isn't being revealed, but it's likely that you're not injecting where you think you're injecting, and an "order by" doesn't go where you've put it. Is the text box in question likely changing / adding something to the database? I'm thinking you might be in an INSERT statement rather than a SELECT. In which case you need to close parenthesis before you do anything else ') – itscooper Jan 4 '19 at 10:59
  • Why do you even think that ORDER BY does show you the number of coloums in the first place? Additionally, why are you not trying to inject commands of your own by correctly terminating the statement you are injecting into and adding a statement of your own? – Tobi Nary Jan 10 '19 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.