[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB
From:       ak () red-database-security ! com
Date:       2005-10-07 9:38:10
Message-ID: 20051007093810.24131.qmail () securityfocus ! com
[Download RAW message or body]

Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB 
#####################################################

 Name                Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB
 Systems Affected    Oracle HTMLDB
 Severity            Medium Risk 
 Category            Cross Site Scripting (CSS/XSS)
 Vendor URL          http://www.oracle.com 
 This advisory       \
http://www.red-database-security.com/advisory/oracle_htmldb_css.html  Author          \
Alexander Kornbrust (ak at red-database-security.com)   Date                7 October \
2005 (V 1.00)

      

Details
#######
Oracle HTML DB is a rapid web application development tool for the Oracle 
database. Using only a web browser and limited programming experience, it 
is possible to develop and deploy professional-looking applications that 
are both fast and secure. 

HTMLDB contains some Cross Site Scritpting vulnerabilities. An attacker 
could abuse these security bugs to execute own SQL statements in the 
database by sending specially crafted HTMLDB url to a HTMLDB user. 


Affected Products
#################
Oracle HTMLDB 


Testcase: (displays the current date (sysdate from a select-command) in a javascript \
message box) #########

http://htmldb.oracle.com/pls/otn/f?p=4500:alert(document.cookie);59:3239664590547916206


http://htmldb.oracle.com/pls/otn/wwv_flow.accept?p_flow_id=4500&p_flow_step_id=3&p_ins \
tance=428576542275032284&p_page_submission_id=3334304&p_request=RUN&p_arg_names=4407099841&p_t01=KORNBRUST&p_arg_names=998876535505&p_t02=select \
sysdate||'alert("'||sysdate||'");' from \
dual%3B&p_arg_names=57198154917561018&p_t03=&p_arg_names=50923815163860037&p_t04=&p_ar \
g_names=64882231271599126&p_t05=&p_arg_names=57064518975385648&p_t06=&p_arg_names=5735 \
6416829253124&p_t07=&p_arg_names=30322022623394012&p_t08=&p_arg_names=106590927281022368&p_t09=&p_md5_checksum= \




Patch Information
#################
This bug is fixed with Critical Patch Update April 2005 (CPU April 2005). Oracle \
forgot  to inform Red-Database-Security that this bug is fixed with CPU April 2005.
Oracle also forgot to mention Red-Database-Security in the credits of CPU April 2005. \



All already published alerts are available on the web site of Red-Database-Security \
GmbH http://www.red-database-security.com/advisory/published_alerts.html


History
#######
18-feb-2004 Oracle secalert was informed

19-feb-2004 Bug confirmed

13-apr-2005 Oracle published CPU April 2005 without informing Red-Database-Security 
that this bug is already fixed. 

07-oct-2005 Red-Database-Security published this advisory


© 2005 by Red-Database-Security GmbH - 7-october-2005 


[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic