SQL Injection Vulnerability in Oracle Hospitality Reporting and Analytics

CVE-2019-2947

Summary

A SQL injection vulnerability exists within the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. This flaw allows a low privileged attacker with Inventory Integration privileges and network access through HTTP to manipulate the system. If exploited, this could lead to unauthorized access to sensitive information, including critical data, as well as potential unauthorized updates, inserts, or deletions of accessible records. Organizations using the affected version should take immediate steps to mitigate this risk to safeguard their data and ensure system integrity.

References