oracle_htmldb_css.txt

`Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB   
#####################################################  
  
Name Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB  
Systems Affected Oracle HTMLDB  
Severity Medium Risk   
Category Cross Site Scripting (CSS/XSS)  
Vendor URL http://www.oracle.com   
This advisory http://www.red-database-security.com/advisory/oracle_htmldb_css.html  
Author Alexander Kornbrust (ak at red-database-security.com)   
Date 7 October 2005 (V 1.00)  
  
  
  
Details  
#######  
Oracle HTML DB is a rapid web application development tool for the Oracle   
database. Using only a web browser and limited programming experience, it   
is possible to develop and deploy professional-looking applications that   
are both fast and secure.   
  
HTMLDB contains some Cross Site Scritpting vulnerabilities. An attacker   
could abuse these security bugs to execute own SQL statements in the   
database by sending specially crafted HTMLDB url to a HTMLDB user.   
  
  
Affected Products  
#################  
Oracle HTMLDB   
  
  
Testcase: (displays the current date (sysdate from a select-command) in a javascript message box)  
#########  
  
http://htmldb.oracle.com/pls/otn/f?p=4500:alert(document.cookie);59:3239664590547916206  
  
http://htmldb.oracle.com/pls/otn/wwv_flow.accept?p_flow_id=4500&p_flow_step_id=3&p_instance=428576542275032284&p_page_submission_id=3334304&p_request=RUN&p_arg_names=4407099841&p_t01=KORNBRUST&p_arg_names=998876535505&p_t02=select sysdate||'alert("'||sysdate||'");' from dual%3B&p_arg_names=57198154917561018&p_t03=&p_arg_names=50923815163860037&p_t04=&p_arg_names=64882231271599126&p_t05=&p_arg_names=57064518975385648&p_t06=&p_arg_names=57356416829253124&p_t07=&p_arg_names=30322022623394012&p_t08=&p_arg_names=106590927281022368&p_t09=&p_md5_checksum=   
  
  
  
Patch Information  
#################  
This bug is fixed with Critical Patch Update April 2005 (CPU April 2005). Oracle forgot   
to inform Red-Database-Security that this bug is fixed with CPU April 2005.  
Oracle also forgot to mention Red-Database-Security in the credits of CPU April 2005.   
  
  
All already published alerts are available on the web site of Red-Database-Security GmbH  
http://www.red-database-security.com/advisory/published_alerts.html  
  
  
History  
#######  
18-feb-2004 Oracle secalert was informed  
  
19-feb-2004 Bug confirmed  
  
13-apr-2005 Oracle published CPU April 2005 without informing Red-Database-Security   
that this bug is already fixed.   
  
07-oct-2005 Red-Database-Security published this advisory  
  
  
© 2005 by Red-Database-Security GmbH - 7-october-2005   
`