oracle_isqlplus_css.txt

`Cross-Site-Scripting Vulnerability in Oracle iSQL*Plus   
######################################################  
  
Name Cross-Site-Scripting Vulnerability in Oracle iSQLPlus  
Systems Affected Oracle Database 9i Rel. 2  
Severity Low Risk   
Category Cross Site Scripting (CSS/XSS)  
Vendor URL http://www.oracle.com  
This advisory http://www.red-database-security.com/advisory/oracle_isqlplus_css.html  
Author Alexander Kornbrust (ak at red-database-security.com)   
Date 7 October 2005 (V 1.00)  
  
  
  
Details  
#######  
Oracle iSQL*Plus is a web interface to SQL*Plus and vulnerable against cross site scripting.  
  
  
Affected Products  
#################  
Oracle Database 9i Release 2   
  
  
Testcase   
########  
  
1. Start iSQLPlus and login as user scott (http://myserver/isqlplus )  
  
2. set markup HTML TABLE ><script>alert(document.cookie);</script>  
  
3. select a table (e.g. select * from cat)  
  
==> a window pops up  
  
  
  
Affected systems   
################  
Tested with Oracle Database 9.0.2.4.   
  
  
Patch Information  
#################  
This bug is fixed with Critical Patch Update July 2005 (CPU July 2005). Oracle   
forgot to inform Red-Database-Security that this bug is fixed with CPU July 2005.  
  
All already published alerts are available on the web site of Red-Database-Security GmbH  
http://www.red-database-security.com/advisory/published_alerts.html  
  
  
History  
#######  
5-nov-2003 Oracle secalert was informed  
  
6-nov-2003 Bug confirmed  
  
12-jul-2005 Oracle published CPU July 2005 without informing Red-Database-Security   
that this bug is already fixed.   
  
07-oct-2005 Red-Database-Security published this advisory  
  
  
© 2005 by Red-Database-Security GmbH - last update 7-october-2005   
`