Oracle PORTAL_DEMO.ORG_CHART SQL Injection

high Nessus Plugin ID 11918

Language:

Synopsis

The remote may be vulnerable to SQL injection attacks.

Description

It is possible to access a demo (PORTAL_DEMO.ORG_CHART) script on the remote host. Access to these pages should be restricted because it may be possible to abuse this demo for SQL Injection attacks.

Additional components of the Portal have been reported as vulnerable to SQL injection attacks but Nessus has not tested for these.

Solution

Remove the Execute for Public grant from the PL/SQL package in schema PORTAL_DEMO (REVOKE execute ON portal_demo.org_chart FROM public;).
Please check also Oracle Security Alert 61 for patch-information.

Plugin Details

Severity: High

ID: 11918

File Name: oracle9i_portaldemo_orgchart.nasl

Version: 1.21

Type: remote

Family: Databases

Published: 11/9/2003

Updated: 6/12/2020

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:oracle:application_server_portal

Required KB Items: Settings/ParanoidReport, www/OracleApache

Exploit Ease: No known exploits are available

Patch Publication Date: 11/3/2003

Vulnerability Publication Date: 11/3/2003

Reference Information

CVE: CVE-2003-1193

BID: 8966

Detections

Analytics