Unscored severity · published Nov 3, 2003
CVE-2003-1193
Multiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages in Oracle Oracle9i Application Server…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages in Oracle Oracle9i Application Server 9.0.2.00 through 3.0.9.8.5 allow remote attackers to execute arbitrary SQL commands via the URL.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Application Server Portal · Oracle
3.0.9.8.5; 9.0.2.3; 9.0.2.3a; 9.0.2.3b · source: NVD
OR
Oracle9i · Oracle
9.0.2; 9.0.2.0.0; 9.0.2.0.1; 9.0.2.1; 9.0.2.2; 9.0.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-1193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-1193
Patch
http://otn.oracle.com/deploy/security/pdf/2003alert61.pdf
Patch
http://www.securityfocus.com/archive/1/343520
Vendor Advisory
http://www.securityfocus.com/bid/8966
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/13593
More from Application Server Portal
–
CVE-2008-2138
Oracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav_portal/portal/ by sending a request…
–
CVE-2007-1506
Cross-site scripting (XSS) vulnerability in PORTAL.wwv_main.render_warning_screen in the Oracle Portal 10g allows remote attackers to inject arbitrary web script or HTML via the…
–
CVE-2006-6699
Multiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response…
–
CVE-2006-6697
CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct…
–
CVE-2004-1707
The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute library files while operating at…