Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB
SecurityAlert : 62 CVE : CVE-2005-3202 SecurityRisk : Medium (About) Remote Exploit : Yes Local Exploit : No Exploit Available : Yes Credit : Alexander Kornbrust Published : 07.10.2005
Affected Software :
Oracle HTMLDB
Advisory Content :
Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB
#####################################################
Name Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB
Systems Affected Oracle HTMLDB
Severity Medium Risk
Category Cross Site Scripting (CSS/XSS)
Vendor URL http://www.oracle.com
This advisory
http://www.red-database-security.com/advisory/oracle_htmldb_css.html
Author Alexander Kornbrust (ak at red-database-security.com)
Date 7 October 2005 (V 1.00)
Details
#######
Oracle HTML DB is a rapid web application development tool for the Oracle
database. Using only a web browser and limited programming experience, it
is possible to develop and deploy professional-looking applications that
are both fast and secure.
HTMLDB contains some Cross Site Scritpting vulnerabilities. An attacker
could abuse these security bugs to execute own SQL statements in the
database by sending specially crafted HTMLDB url to a HTMLDB user.
Affected Products
#################
Oracle HTMLDB
Testcase: (displays the current date (sysdate from a select-command) in a
javascript message box)
#########
http://htmldb.oracle.com/pls/otn/wwv_flow.accept?p_flow_id=4500&p_flow_s
tep_id=3&p_instance=428576542275032284&p_page_submission_id=3334304&p_re
quest=RUN&p_arg_names=4407099841&p_t01=KORNBRUST&p_arg_names=99887653550
5&p_t02=select sysdate||'alert("'||sysdate||'");' from
dual%3B&p_arg_names=57198154917561018&p_t03=&p_arg_names=509238151638600
37&p_t04=&p_arg_names=64882231271599126&p_t05=&p_arg_names=5706451897538
5648&p_t06=&p_arg_names=57356416829253124&p_t07=&p_arg_names=30322022623
394012&p_t08=&p_arg_names=106590927281022368&p_t09=&p_md5_checksum=
Patch Information
#################
This bug is fixed with Critical Patch Update April 2005 (CPU April 2005).
Oracle forgot
to inform Red-Database-Security that this bug is fixed with CPU April 2005.
Oracle also forgot to mention Red-Database-Security in the credits of CPU
April 2005.
All already published alerts are available on the web site of
Red-Database-Security GmbH
http://www.red-database-security.com/advisory/published_alerts.html
History
#######
18-feb-2004 Oracle secalert was informed
19-feb-2004 Bug confirmed
13-apr-2005 Oracle published CPU April 2005 without informing
Red-Database-Security
that this bug is already fixed.
07-oct-2005 Red-Database-Security published this advisory
If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.