Description

bdamele

opened on Jun 26, 2012

Issue body actions

When stacked queries is supported use OPENROWSET (MSSQL) and dblink() (PostgreSQL) to run a statement as a different user (e.g. higher privileged user for instance after a password cracking attack).

The same library code can be used in ticket #31.

Activity

1. ghost assigned

   bdamele

   on Jun 26, 2012
2. bdamele

   added a commit that references this issue on Jul 1, 2012

   added skeleton code for issue #34, still not usable

   7b4ecd9
3. bdamele commented on Jul 2, 2012

   

   bdamele

   on Jul 2, 2012

   MemberAuthor

   More actions

   First rough implementation in commit 6697927 (forgot to reference this issue in the commit message)
4. bdamele

   added 3 commits that reference this issue on Jul 2, 2012

   more tweaking for issue #34, it's totally not as trivial as it may lo…

   04d803c

   cleanup for #34

   99c5ea5

   finally got this working on MSSQL 2005: commands can now be executed …

   25eca9d
5. bdamele commented on Jul 9, 2012

   

   bdamele

   on Jul 9, 2012

   MemberAuthor

   More actions

   Done for MSSQL.
6. bdamele commented on Jul 12, 2012

   

   bdamele

   on Jul 12, 2012

   MemberAuthor

   More actions

   As of PostgreSQL 9.1, dblink() function is still in the contrib folder and not packaged by default:

   [...] modules that can be found in the contrib directory of the PostgreSQL distribution. These include porting tools, analysis utilities, and plug-in features that are not part of the core PostgreSQL system [...]

   It requires the DBA to manually compile PostgreSQL and run the dblink.sql statement to create the function before being usable.

   Hence, shall we support it despite there're very little chances we ever find it available? Comments are welcome.
7. stamparm commented on Jul 12, 2012

   

   stamparm

   on Jul 12, 2012

   Member

   More actions

   Currently Google says 135.000 results for search query: dblink postgresql. That doesn't say anything that if the task is not too hard to be accomplished it wouldn't be something of total lack of practical usage.

Issue actions