Red-Database-Security GmbH is specialized in Oracle Security

Products
Repscan 2.5
Hedgehog Enterprise
Checkpwd (free)

Services
Oracle Audit / Hardening
Security Training
Consulting

Information
Oracle Security Blog
Published AlertsRSS Published Alerts
Upcoming AlertsRSS Published Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Tutorials
Videos
Scripts

News & Events
Events
News

Company
Contact
People
Partner
Impressum
Sitemap


Search



Search Red-Database-Security
Cross-Site-Scripting Vulnerability in Oracle iSQL*Plus

Name Cross-Site-Scripting Vulnerability in Oracle iSQL*Plus
Systems Affected Oracle Database 9i Rel. 2
Severity Low Risk
Category Cross Site Scripting (CSS/XSS)
Vendor URL http://www.oracle.com/
Author Alexander Kornbrust (ak at red-database-security.com)
Date 7 October 2005 (V 1.00)


Details
Oracle iSQL*Plus is a web interface to SQL*Plus and vulnerable against cross site scripting.

Affected Products
Oracle Database 9i Release 2

Patch Information
This bug is fixed with Critical Patch Update July 2005 (CPU July 2005).
Oracle forgot to inform Red-Database-Security that this bug is fixed with CPU July 2005.

Testcase
1. Start iSQLPlus and login as user scott (http://myserver/isqlplus )

2. set markup HTML TABLE ><script>alert(document.cookie);</script>

3. select a table (e.g. select * from cat)

==> a window pops up



History
5-nov-2003 Oracle secalert was informed
6-nov-2003 Bug confirmed
12-jul-2005 Oracle published CPU July 2005 without informing Red-Database-Security that this bug is already fixed.
07-oct-2005 Red-Database-Security published this advisory



2005 by Red-Database-Security GmbH - last update 03-nov-2005

Oracle iSQL*Plus

iSQL*Plus is a browser-based interface to SQL*Plus.

iSQL*Plus is shipped with the Oracle10g Database Server.