SQL Injection Vulnerability in PeopleSoft SCM by Oracle

CVE-2021-35541

Summary

An exploitable SQL injection vulnerability exists in the Supplier Portal component of Oracle's PeopleSoft Enterprise SCM product, which affects version 9.2. This vulnerability allows a low-privileged attacker with network access via HTTP to manipulate the database. To successfully exploit this vulnerability, the attacker must have human interaction from another user. The consequences of such attacks may include unauthorized updates, inserts, deletes, and read access to sensitive data, significantly impacting the confidentiality and integrity of PeopleSoft Enterprise SCM data. Organizations using this product should take immediate action to mitigate potential risks.

References