CVE-2007-2111: SQL Injection

Published Apr 18, 2007

Updated

SQL injection vulnerability in the SYS.DBMSAQADMSYS package in Oracle Database 9.0.1.5, 9.2.0.7, and 10.1.0.5 allows remote authenticated users to inject arbitrary SQL commands via unknown vectors, aka DB04. NOTE: as of 20070424, Oracle has not disputed reliable claims that DB04 is actually for multiple vulnerabilities.

Affected Software

3 affected components

Oracle Database Server=9.0.1.5

Oracle Database Server=9.2.0.7

Oracle Database Server=10.1.0.5

Remediation

Patch Available

http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_aqadm_sys.html

Event History

Apr 18, 2007

CVE Published

06:19 PM

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2111?

CVE-2007-2111 is considered a high severity vulnerability due to its potential for remote SQL injection attacks.

How do I fix CVE-2007-2111?

To fix CVE-2007-2111, it is recommended to update Oracle Database to a patched version that addresses this vulnerability.

Which versions of Oracle Database are affected by CVE-2007-2111?

CVE-2007-2111 affects Oracle Database versions 9.0.1.5, 9.2.0.7, and 10.1.0.5.

Who can exploit CVE-2007-2111?

CVE-2007-2111 can be exploited by remote authenticated users who can inject arbitrary SQL commands.

What are the consequences of CVE-2007-2111?

The consequences of exploiting CVE-2007-2111 include unauthorized access to data and the potential compromise of database integrity.