SQL Injection Vulnerability in Oracle Database Server 10g
CVE-2005-4832

Currently unrated

Key Information:

Vendor

Oracle
Status
Oracle10g
Vendor
CVE Published:
31 December 2005

What is CVE-2005-4832?

The Oracle Database Server 10g contains a SQL injection vulnerability that allows remote authenticated users to execute arbitrary SQL commands with elevated privileges by exploiting the SUBSCRIPTION_NAME parameter within the SYS.DBMS_CDC_SUBSCRIBE and SYS.DBMS_CDC_ISUBSCRIBE packages. This flaw provides attackers with a pathway to interact with the database in unauthorized ways, potentially leading to data breaches or corruption. This vulnerability represents an important security concern, ultimately necessitating prompt attention and remediation to safeguard sensitive data.

References

http://www.securityfocus.com/archive/1/396133
mailing-listx_refsource_BUGTRAQ
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWor...
x_refsource_MISC
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExp...
x_refsource_MISC

EPSS Score

52% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.