CVE-2007-5508: SQL Injection

Published Oct 17, 2007

Updated

Multiple SQL injection vulnerabilities in the CTXSYS Intermedia application for the Oracle Text component (CTXDOC) in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) THEMES, (2) GIST, (3) TOKENS, (4) FILTER, (5) HIGHLIGHT, and (6) MARKUP procedures, aka DB03. NOTE: remote unauthenticated attack vectors exist when CTXSYS is used with oracle Application Server.

Affected Software

2 affected components

Oracle Database Server=10.1.0.5

Oracle Database Server=10.2.0.3

Event History

Oct 17, 2007

CVE Published

11:17 PM

Oct 18, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5508?

CVE-2007-5508 is considered a high severity vulnerability due to its potential for remote SQL injection attacks.

How do I fix CVE-2007-5508?

To mitigate CVE-2007-5508, upgrade to a patched version of the Oracle Database that addresses this vulnerability.

Who is affected by CVE-2007-5508?

CVE-2007-5508 affects users running Oracle Database versions 10.1.0.5 and 10.2.0.3.

What are the potential impacts of CVE-2007-5508?

The impacts of CVE-2007-5508 include the ability for authenticated users to execute arbitrary SQL commands, potentially compromising database integrity.

What components are vulnerable in CVE-2007-5508?

CVE-2007-5508 specifically affects the CTXSYS Intermedia application for the Oracle Text component, affecting various functions like THEMES, GIST, and TOKENS.