CVE-2007-5766: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in okxLOV.jsp in Oracle E-Business Suite 11 and 12 allows remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: this is probably the same issue as CVE-2007-5527 or CVE-2007-5528, but there are insufficient details to be sure...

Oracle E-Business套件SQL注入漏洞

Oracle E-Business Suite是一款Oracle公司推出的电子商务套件。 Oracle E-Business Suite存在SQL注入问题，远程攻击者可以利用漏洞获得敏感信息或操作数据库。 问题存在于管理控制台中的okxLOV.jsp脚本，此页面允许攻击者指定参数给WHERE SQL命令而没有做任何过滤，导致以APPS用户权限执行任意SQL注入。 E-Business Suite 11 E-Business Suite 12 可参考如下安全公告获得补丁信息：...