Uploaded image for project: 'MariaDB Connector/ODBC'
  1. MariaDB Connector/ODBC
  2. ODBC-505

Positioned operations do not quote column names

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 3.2.9
    • 3.2.10
    • General
    • None

    Description

      To execute SQLSetPos or SQLBulkOPerations the driver constructs queries. It those queries it does not quote column names. If the name contained some special character, that could cause error.
      Malicious server could exploit this for SQL injection.

      Attachments

        Activity

          People

            Lawrin Lawrin Novitsky
            Lawrin Lawrin Novitsky
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.