Cross-Site-Scripting Vulnerability in Oracle iSQL*Plus ###################################################### Name Cross-Site-Scripting Vulnerability in Oracle iSQLPlus Systems Affected Oracle Database 9i Rel. 2 Severity Low Risk Category Cross Site Scripting (CSS/XSS) Vendor URL http://www.oracle.com This advisory http://www.red-database-security.com/advisory/oracle_isqlplus_css.html Author Alexander Kornbrust (ak at red-database-security.com) Date 7 October 2005 (V 1.00) Details ####### Oracle iSQL*Plus is a web interface to SQL*Plus and vulnerable against cross site scripting. Affected Products ################# Oracle Database 9i Release 2 Testcase ######## 1. Start iSQLPlus and login as user scott (http://myserver/isqlplus ) 2. set markup HTML TABLE ><script>alert(document.cookie);</script> 3. select a table (e.g. select * from cat) ==> a window pops up Affected systems ################ Tested with Oracle Database 9.0.2.4. Patch Information ################# This bug is fixed with Critical Patch Update July 2005 (CPU July 2005). Oracle forgot to inform Red-Database-Security that this bug is fixed with CPU July 2005. All already published alerts are available on the web site of Red-Database-Security GmbH http://www.red-database-security.com/advisory/published_alerts.html History ####### 5-nov-2003 Oracle secalert was informed 6-nov-2003 Bug confirmed 12-jul-2005 Oracle published CPU July 2005 without informing Red-Database-Security that this bug is already fixed. 07-oct-2005 Red-Database-Security published this advisory &#169; 2005 by Red-Database-Security GmbH - last update 7-october-2005