Can you use null byte injection to exploit SQLi in Postgres?

Asked Jul 14 '16 at 06:31

Active Jul 14 '16 at 08:22

Viewed 591 times

While testing, I do get an error when passing the input asdf%00 to my applications username. The database in the backend spits an error, because Postgre can't handle 0x00 in text fields.

 <h4>PersistencyException</h4>
    <pre><code><strong>org.postgresql.util.PSQLException: FEHLER: ungültige Byte-Sequenz für Kodierung „UTF8“: 0x00</strong></code></pre>

Is this exploitable with an SQL injection, or do I assume correctly that it isn't?

edited Jul 14 '16 at 08:22

Anders

64,406
24
178
215

asked Jul 14 '16 at 06:31

user857990

2

There isn't enough information here to determine if there is an SQL injection or not – wireghoul Jul 14 '16 at 12:14

Can you use null byte injection to exploit SQLi in Postgres?

0 Answers0