Hi, I have another question, somehow related with my previous one.
I have an injection point, where I can do, for example test.asp?param=blabla' and 1=(select @@version)-- and injections of the sort, and retrieve the information without problems. Now, when I try to execute a stored procedure like test.asp?param=blabla' exec master..xp_cmdshell 'dir'-- or test.asp?param=blabla'; exec master..xp_cmdshell 'dir'-- I get the following error: Microsoft OLE DB Provider for SQL Server error '80040e14' sp_cursoropen/sp_cursorprepare: The statement parameter can only be a single select or a single stored procedure. Does anybody got an idea of why this is happening? Best Regards, Andy. _________________________________________________________________ Dale rienda suelta a tu tiempo libre. Mil ideas para exprimir tu ocio con MSN Entretenimiento. http://entretenimiento.msn.es/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/