CVE Feed

    Dashboard / CVE / CVE-2005-4832

    CVE-2005-4832

    SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.

    Published:Dec 31, 2005
    Last Modified:Apr 16, 2026
    EPS:Mar 3, 2007
    EPSS Score:0.71117
    CVSS Score:7.5

    Affected Products

    Vendor
    Oracle
    Product
    Oracle10g

    Exploits

    http://www.appsecinc.com/resources/alerts/oracle/2005-02.htmlhttp://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txthttp://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sqlhttp://www.securityfocus.com/archive/1/396133http://www.securityfocus.com/archive/1/404970http://www.appsecinc.com/resources/alerts/oracle/2005-02.htmlhttp://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txthttp://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sqlhttp://www.securityfocus.com/archive/1/396133http://www.securityfocus.com/archive/1/404970https://www.exploit-db.com/exploits/25452https://www.exploit-db.com/exploits/25453https://www.exploit-db.com/exploits/3364https://www.exploit-db.com/exploits/3378

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2007-3856 (CVSS 6.5) — Unspecified vulnerability in the Oracle Data Mining component for Oracle Database 10g Release 2 10.2.0.2 and 1…
    CVE-2006-6703 (CVSS 6.8) — Multiple cross-site scripting (XSS) vulnerabilities in Oracle Portal 9i and 10g allow remote attackers to inje…
    CVE-2006-1705 (CVSS 2.1) — Oracle Database 9.2.0.0 to 10.2.0.3 allows local users with "SELECT" privileges for a base table to insert, up…
    CVE-2006-0586 (CVSS 7.5) — Multiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to e…
    CVE-2006-0552 (CVSS 7.5) — Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FI…
    CVE-2006-0272 (CVSS 9) — Unspecified vulnerability in the XML Database component of Oracle Database server 9.2.0.7 and 10.1.0.4 has uns…
    CVE-2006-0262 (CVSS 10) — Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.…
    CVE-2006-0271 (CVSS 10) — Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2…
    CVE-2006-0269 (CVSS 5.5) — Unspecified vulnerability in the Streams Capture component of Oracle Database server 10.1.0.5 and 10.2.0.1 has…
    CVE-2005-3641 (CVSS 7.5) — Oracle Databases running on Windows XP with Simple File Sharing enabled, allows remote attackers to bypass aut…

    References

    http://www.appsecinc.com/resources/alerts/oracle/2005-02.html
    http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txt
    http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sql
    http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf
    http://www.securityfocus.com/archive/1/396133
    http://www.securityfocus.com/archive/1/404970
    http://www.securityfocus.com/bid/13236
    https://exchange.xforce.ibmcloud.com/vulnerabilities/20159
    http://www.appsecinc.com/resources/alerts/oracle/2005-02.html
    http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txt
    http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sql
    http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf
    http://www.securityfocus.com/archive/1/396133
    http://www.securityfocus.com/archive/1/404970
    http://www.securityfocus.com/bid/13236
    https://exchange.xforce.ibmcloud.com/vulnerabilities/20159

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High