title: Sql Injection MS Access
body: <p>I am on a pen test doing a 3rd party validation of a vendor's staging web server  &amp; have found an instance of IIS  that appears to be running MS-Access as its backend database. I think that I may have found a potential SQLi attack vector but need some verification.  I have done some research on SQLi exploits with MS-Access &amp; have not really gotten any useful information relevant to my situation.</p>
  
  <p>When I initially accessed the login page I entered '1 OR 1=1' as the user name to see if I could get some low hanging fruit. Here is the error message that I got:</p>
  
  <p>HTTP 500.100 - Internal Server Error - ASP error
  Internet Information Services</p>
  
  <p>Technical Information (for support personnel)</p>
  
  <pre><code>Error Type:
  Microsoft OLE DB Service Components (0x80040E73)
  Format of the initialization string does not conform to the OLE DB specification.
  /arnisi/start.asp, line 204
  
  Browser Type:
  Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1
  
  Page:
  POST 196 bytes to /arnisi/start.asp
  
  POST Data:
  username=%271+OR+1%3D1%27&amp;password=&amp;dataSource=mkgt13&amp;lang=en&amp;database=esuite&amp;  provider=SQLOLEDB&amp;FromLoginPage=1&amp;dir=ltr&amp;screenHeight=900&amp;screenWidth=1600&amp;browserType=NS&amp;browserVer=6&amp;font=arial
  </code></pre>
  
  <p>The interesting thing is that the error shows the datasource to be mkgt1 and the database to be esuite. The thing that is killing me is the syntax for running queries on MS-Access. Is this possible? Any help would be greatly appreciated.</p>