CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 7.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: multiple sql injection vulnerabilities in oracle 10g release 1 before cpu jan 2006 allow remote attackers to execute arbitrary sql commands via multiple parameters in (1) attach_job, (2) has_privs, and (3) open_job functions in the sys.kupv$ft package; and (4) update_job, (5) active_job, (6) attach_possible, (7) attach_to_job, (8) create_new_job, (9) delete_job, (10) delete_master_table, (11) detach_job, (12) get_job_info, (13) get_job_queues, (14) get_sole_jobname, (15) master_tbl_lock, and (16) valid_handle functions in the sys.kupv$ft_int package.  note: due to the lack of relevant details from the oracle advisory, a separate cve is being created since it cannot be conclusively proven that these issues has been addressed by oracle.  it is unclear which, if any, oracle vuln# identifiers apply to these issues.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2006-02-08
Last Modified Date: 2018-10-19