sql injection in oracle

hi

i'm not sure this is the right mailing list to ask
such questions or not..but here i goes.
currently i'm pen-testing a client. here's what i got:

SQL Error - ORA-00920: invalid relational operator
select distinct INITCAP(client_name)||'
('||INITCAP(client_title)||')',
ltrim(rtrim(initcap(CLIENT_ACAD_PRO))), sp.client_id
from client_profile sp, client_academic sa where
sp.client_id = sa.client_id and
upper(sa.client_ACAD_PRO) like %'INJECT'%' UNION ALL
SELECT * FROM client_PROFILE WHERE '%' and
sp.client_status = '01' order by 2,1

how i got there was i just append the string 
?variable='INJECT' to a jsp page. i can
successfully(?) break out of the % by typing
?scope='%20union%20all%20select%20*%20from%20othertable%20where%20=
and it just returns a blank page instead of the error
page.

I'd like to know what kind of query should i try in
this page in order to fully exploit the sql injection?

any help is greatly appreciated.
p/s: if i'm in the wrong mailing list, please direct
me to the right one



		
__________________________________ 
Yahoo! Mail - PC Magazine Editors' Choice 2005 
http://mail.yahoo.com