QwikSec

Security Database

CVE

CWE

Training

CVE-2005-4832

Published: Mar 3, 2007

Modified: Aug 8, 2024

PUBLISHED

Description

SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20050418 [AppSecInc Team SHATTER Security Advisory] Multiple SQL Injection vulnerabilities in DBMS_CDC_SUBSCRIBE and DBMS_CDC_ISUBSCRIBE packages

mailing-list

x_refsource_BUGTRAQ

http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sql

x_refsource_MISC

http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txt

x_refsource_MISC

http://www.appsecinc.com/resources/alerts/oracle/2005-02.html

x_refsource_MISC

20050711 Re: Problems with the Oracle Critical Patch Update for April 2005

mailing-list

x_refsource_BUGTRAQ

http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf

x_refsource_CONFIRM

vdb-entry

x_refsource_BID

oracle-subscriptionname-sql-injection(20159)

vdb-entry

x_refsource_XF

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.