Oracle Database SUBSCRIPTION_NAME Parameter SQL Injection (CVE-2005-1197)

Oracle Database Server is an enterprise-level relational database application suite. To extend the functionality of the Oracle Database Server, extra packages of related program objects, i.e. procedures, functions, variables, constants, cursors, and exceptions, are provided to the database user i...

CVE-2005-4832: Undefined Security Weakness

SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTIONNAME parameter in the 1 SYS.DBMSCDCSUBSCRIBE and 2 SYS.DBMSCDCISUBSCRIBE packages, a different vector than CVE-2005-1197...

Oracle 10g Database - SUBSCRIPTION_NAME SQL Injection (1)

Oracle 10g Database - SUBSCRIPTIONNAME SQL Injection 1 source: https://www.securityfocus.com/bid/13236/info Oracle database is prone to an SQL-injection vulnerability because the software fails to properly sanitize user-supplied data. The 'SUBSCRIPTIONNAME' parameter is vulnerable. Packages that...

Oracle 10g Database - 'SUBSCRIPTION_NAME' SQL Injection (1)

source: https://www.securityfocus.com/bid/13236/info Oracle database is prone to an SQL-injection vulnerability because the software fails to properly sanitize user-supplied data. The 'SUBSCRIPTIONNAME' parameter is vulnerable. Packages that employ this parameter execute with 'SYS' user privilege...