CVE-2006-7138

CWE-89 — SQL Injection3 documents3 sources
Severity
6.0MEDIUM
EPSS
1.5%
top 19.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Oracle Apex
Timeline
PublishedMar 7
Latest updateMay 1

Description

SQL injection vulnerability in wwv_flow_utilities.gen_popup_list in the WWV_FLOW_UTILITIES package for Oracle APEX/HTMLDB before 2.2 allows remote authenticated users to execute arbitrary SQL by modifying the P_LOV parameter and calculating a matching MD5 checksum for the P_LOV_CHECKSUM parameter. NOTE: it is likely that this issue is subsumed by CVE-2006-5351, but due to lack of details from Oracle, this cannot be proven.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 6.8 | Impact: 6.4

Affected Packages1 packages

▶NVDoracle/apex2.1

Patches

Patch: www.red-database-security.com ↗Patch: www.red-database-security.com ↗Patch: www.red-database-security.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-jq8f-42gf-23cj: SQL injection vulnerability in wwv_flow_utilities↗2022-05-01
▶
CVEList
CVE-2006-7138: SQL injection vulnerability in wwv_flow_utilities↗2007-03-07
▶
CVE-2006-7138 (MEDIUM CVSS 6) | SQL injection vulnerability in wwv_ | cvebase.io