Stored procedure without string concatenation SQL Injection vulnerabilities - sql

Question

I'm using SQL Server 2005/2008, I have a stored procedure that doesn't use string concatenation for generating an EXEC statement, but it does use a dynamic name for the stored procedure.
I think the #stored_procedure_name and potentially the #object_name parameter are both vulnerable. However all the Dynamic SQL links I read assume that you are concatenating your SQL statement inside a string - so I'm wondering if it might actually be OK.
Note, just for posting this, I've made the code generic by calling the table objects - so it might not necessarily make logical sense.
Here is the code:
CREATE PROCEDURE [dbo].[my_dodgy_sp]
#object_name varchar(50) = 'All'
AS
BEGIN
DECLARE #stored_procedure_name varchar(100);
DECLARE object_cursor CURSOR FOR
SELECT stored_procedure_name
FROM [dbo].[objects]
WHERE [stored_procedure_name] <> ''
AND ([name] = #object_name)
OPEN object_cursor
FETCH NEXT FROM object_cursor
INTO #stored_procedure_name
WHILE ##FETCH_STATUS = 0
BEGIN
EXEC #stored_procedure_name #object_id OUTPUT;
FETCH NEXT FROM object_cursor
INTO #stored_procedure_name
END
CLOSE object_cursor;
DEALLOCATE object_cursor;
END

Answer 1

Try this:
CREATE PROCEDURE [dbo].[my_dodgy_sp]
#object_name varchar(50) = 'All'
AS
BEGIN
DECLARE #stored_procedure_name sysname, #oID INT, #sql NVARCHAR(MAX), #object_id int;
DECLARE object_cursor CURSOR FOR
SELECT object_id, name
FROM sys.procedures
WHERE [name] = #object_name
OPEN object_cursor
FETCH NEXT FROM object_cursor
INTO #oID, #stored_procedure_name
WHILE ##FETCH_STATUS = 0
BEGIN
SET #sql = N'EXEC ['+OBJECT_SCHEMA_NAME(#oid)+N'].['+#stored_procedure_name+N'] #Object_id OUTPUT'
EXEC sp_executesql #sql, N'#object_id int OUTPUT', #ObjectId =#object_id OUTPUT
PRINT #object_id -- we need to do smth with it?
FETCH NEXT FROM object_cursor
INTO #oID, #stored_procedure_name
END
CLOSE object_cursor;
DEALLOCATE object_cursor;
END
BUT
instead of using such a complicated way, may be you just call the parametrized procedure?