Published: 31/12/2005 Updated: 29/07/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 770

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle oracle10g enterprise_9.0.4_.0
oracle oracle10g personal_10.1.0.2
oracle oracle10g personal_9.0.4_.0
oracle oracle10g standard_10.1.0.2
oracle oracle10g standard_10.2.0.1
oracle oracle10g standard_10.2.3
oracle oracle10g enterprise_10.1.0.2
oracle oracle10g enterprise_10.1.0.3
oracle oracle10g personal_10.1.0.3
oracle oracle10g enterprise_10.2.3
oracle oracle10g enterprise_9.0.4.0
oracle oracle10g personal_10.2.3
oracle oracle10g personal_9.0.4.0
oracle oracle10g standard_10.1.0.5
oracle oracle10g standard_10.1_.0.2
oracle oracle10g personal_10.1.0.3.1
oracle oracle10g standard_10.1.0.3
oracle oracle10g standard_10.1.0.3.1
oracle oracle10g standard_9.0.4.0
oracle oracle10g standard_9.0.4_.0
oracle oracle10g enterprise_10.1.0.3.1
oracle oracle10g enterprise_10.1.0.4
oracle oracle10g personal_10.1.0.4
oracle oracle10g personal_10.1_.0.2
oracle oracle10g personal_10.10.3.1
oracle oracle10g standard_10.1.0.4
oracle oracle10g standard_10.1.0.4.2

source: wwwsecurityfocuscom/bid/13236/info Oracle database is prone to an SQL-injection vulnerability because the software fails to properly sanitize user-supplied data The 'SUBSCRIPTION_NAME' parameter is vulnerable Packages that employ this parameter execute with 'SYS' user privileges Exploiting the SQL-injection vulnerability can a ...

#!/usr/bin/perl # # Remote Oracle DBMS_CDC_SUBSCRIBEACTIVATE_SUBSCRIPTION exploit (9i/10g) # - Version 2 - New "evil cursor injection" tip! # - No "create procedure" privileg needed! # - See: wwwdatabasesecuritycom/ (Cursor Injection) # # Grant or revoke dba permission to unprivileged user # # Tested on "Oracle Database 10g Enterprise ...

#!/usr/bin/perl # # Remote Oracle DBMS_CDC_SUBSCRIBEACTIVATE_SUBSCRIPTION exploit (9i/10g) # # Grant or revoke dba permission to unprivileged user # # Tested on "Oracle Database 10g Enterprise Edition Release 101030" # # REF: wwwsecurityfocuscom/archive/1/396133 # # AUTHOR: Andrea "bunker" Purificato # rawlab ...

source: wwwsecurityfocuscom/bid/13236/info Oracle database is prone to an SQL-injection vulnerability because the software fails to properly sanitize user-supplied data The 'SUBSCRIPTION_NAME' parameter is vulnerable Packages that employ this parameter execute with 'SYS' user privileges Exploiting the SQL-injection vulnerability can ...

NVD-CWE-Other http://www.securityfocus.com/archive/1/396133 http://www.securityfocus.com/archive/1/404970 http://www.appsecinc.com/resources/alerts/oracle/2005-02.html http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txt http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sql http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf http://www.securityfocus.com/bid/13236 https://exchange.xforce.ibmcloud.com/vulnerabilities/20159 https://nvd.nist.gov https://www.exploit-db.com/exploits/25452/

CVE-2005-4832

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect