Login Request a demo
Unscored severity · published Sep 20, 2005
CVE-2005-2983
SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that…
–
CVSS
2.2%
EPSS
No
On KEV
Description
SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the paramform parameter is set to yes.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Reports · Oracle
1.00 · source: NVD
Affected product
RE
Reports
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2983
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2983
Exploit
http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/037156.html
marc.info
http://marc.info/?l=bugtraq&m=112681849113948&w=2
Exploit
http://www.red-database-security.com/wp/sql_injection_reports_us.pdf
More from Reports
–
CVE-2005-2371
Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3)…
–
CVE-2005-2378
Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat…
–
CVE-2005-2379
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) debug parameter to showenv,…
–
CVE-2002-0947
Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows remote attackers to execute arbitrary…
–
CVE-2002-1089
rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote attackers to use the information in…