bugtraq - SQL Injection Vulnerability in Oracle WWV_FLOW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20061023163202.18408.qmail@securityfocus.com>
Date: 23 Oct 2006 16:32:02 -0000
From: ak@...-database-security.com
To: bugtraq@...urityfocus.com
Subject: SQL Injection Vulnerability in Oracle WWV_FLOW_UTILITIES

###########################################################

Name		SQL Injection Vulnerability in Oracle WWV_FLOW_UTILITIES
Systems 	Affected Oracle APEX/HTMLDB
Severity   	High Risk
Category   	SQL Injection
Vendor URL 	http://www.oracle.com/
Author 	        Alexander Kornbrust (ak at red-database-security.com)
Date 	      18 October 2006 (V 1.00)
Advisory     http://www.red-database-security.com/advisory/oracle_apex_sql_injection_wwv_flow_utilities.html

Details
#######
The list of values (LOV) in wwv_flow_utilities.gen_popup_list contains a SQL 
injection vulnerability. Depending of the APEX application it is possible 
to inject custom SQL statements. The entire SQL statement is accessible from 
the URL in the parameter P_LOV. To protect the SELECT statement in the URL 
Oracle is using a MD5 checksum. By modifying the SQL statement and recalculating 
the MD5 checksum P_LOV_CHECKSUM it is possible to run custom SQL statements 
from the URL.

Sample URL:
http://apex:7777/pls/htmldb/wwv_flow_utilities.gen_popup_list?p_filter=&p_name=p_t02&p_element_index=1&p_hidden_elem_name=p_t01&p_form_index=0&p_max_elements=&p_escape_html=&p_ok_to_query=YES&p_flow_id=100&p_page_id=11&p_session_id=15108399238201864297&p_eval_value=&p_return_key=YES&p_translation=N&p_lov=select%20cust_last_name%20||%20'%2C%20'%20||%20cust_first_name%20d%2C%20customer_id%20r%20from%20demo_customers%20order%20by%20cust_last_name&p_lov_checksum=82C7EFB6FA3A2FA2C6E1A70FB63BB064

Affected Products
#################
This bug is fixed with 2.2 of APEX which is not part of the Critical Patch 
Update October 2006. It's necessary to upgrade your APEX/HTMLDB installation 
to 2.2 or better 2.2.1.

Patches are currently not available for Oracle Application Express.

Patch Information
#################
This bug is fixed with Apex 2.2 or higher.

History
#######
03-oct-2005 Oracle secalert was informed
04-oct-2005 Bug confirmed
17-oct-2006 Oracle published CPU October 2006 and recommends to update to 2.2.1
18-oct-2006 Red-Database-Security published this advisory

Additional Information
######################
An analysis of the Oracle CPU Oct 2006 is available here http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html