Assume a University website has a procedure named DISPLAY_GPA(), see the procedure code below. When a student runs the procedure with his or her ID number, the procedure will display the student's name and his or her GPA. set serveroutput on; CREATE OR REPLACE PROCEDURE DISPLAY_ GPA ( P_ Stdid STUDENT.Stdid%Type) AS Stmt CONSTANT VARCHAR2(3000);= 'SELECT stdfn, stdin, StdGPA from Student Where StdiD ='’’ || P_Stdid || “”; Fname varchar2(30); Lname varchar2(30); GPA number(4); BEGIN DBMS Output.Put_Line (SQL Stmt:’|| Stmt); EXECUTE IMMEDIATE stmt into fname, Lname, GPA; DBMS OUTPUT.PUT_LINE(fname || ‘’|| Lname || ‘’| | GPA); End DISPLAY GPA/ Show error; Example of legitimate use: End DISPLAY_GPA (104); Output SQL Stmt: SELECT stdfn, stdin, StdGPA from Student Where StdiD = ‘104’ Sue Williams 3 PL/SQL procedure successfully completed. Assume you know someone whose last name is Roberson. Use SQL Injection technique to gain unauthorized access to at least two student's GPAs. EXEC DISPLAY (); EXEC DISPLAY_GPA ();
Assume a University website has a procedure named DISPLAY_GPA(), see the procedure code below. When a student runs the procedure with his or her ID number, the procedure will display the student's name and his or her GPA.
set serveroutput on;
CREATE OR REPLACE PROCEDURE DISPLAY_ GPA ( P_ Stdid STUDENT.Stdid%Type) AS
Stmt CONSTANT VARCHAR2(3000);= 'SELECT stdfn, stdin, StdGPA from Student Where StdiD ='’’ || P_Stdid || “”;
Fname varchar2(30);
Lname varchar2(30);
GPA number(4);
BEGIN
DBMS Output.Put_Line (SQL Stmt:’|| Stmt);
EXECUTE IMMEDIATE stmt into fname, Lname, GPA;
DBMS OUTPUT.PUT_LINE(fname || ‘’|| Lname || ‘’| | GPA);
End DISPLAY GPA/
Show error;
Example of legitimate use:
End DISPLAY_GPA (104);
Output
SQL Stmt: SELECT stdfn, stdin, StdGPA from Student Where StdiD = ‘104’
Sue Williams 3
PL/SQL procedure successfully completed.
Assume you know someone whose last name is Roberson. Use SQL Injection technique to gain unauthorized access to at least two student's GPAs.
- EXEC DISPLAY ();
- EXEC DISPLAY_GPA ();
Trending now
This is a popular solution!
Step by step
Solved in 2 steps
