vulnwire
6.5med

CVE-2007-55114 exploits

SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attack…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
6.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
31.8%
percentile 98%
Public exploits
4
Metasploit · Exploit-DB

SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attackers to execute arbitrary SQL commands via the FINDRICSET procedure in the LT package. NOTE: this is probably covered by CVE-2007-5510, but there are insufficient details to be certain.

Exploit prediction (EPSS)

31.76% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • Metasploit auxiliary/sqli/oracle/lt_findricset_cursor Oracle DB SQL Injection via SYS.LT.FINDRICSET Evil Cursor Method · metasploit auxiliary, normal rank · 2007-10-17
  • EDB-4572 Oracle 10g - 'LT.FINDRICSET' SQL Injection (IDS Evasion) · local · 2007-10-27
  • EDB-4571 Oracle 10g/11g - 'SYS.LT.FINDRICSET' SQL Injection (2) · local · 2007-10-27
  • EDB-4570 Oracle 10g/11g - 'SYS.LT.FINDRICSET' SQL Injection (1) · local · 2007-10-27

CVSS scores

Assigned byVersionScoreVector
NVD2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Technology feeds
Oracle Database (RSS, critical only)

References

  • securityfocus.com /archive/1/482429/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • vupen.com /english/advisories/2007/3524 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /bid/26098 · vdb-entry, x_refsource_BID, x_transferred
  • vupen.com /english/advisories/2007/3626 · vdb-entry, x_refsource_VUPEN, x_transferred
  • exploit-db.com /exploits/4571 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • marc.info /?l=bugtraq&m=119332677525918&w=2 · vendor-advisory, x_refsource_HP, x_transferred
  • exploit-db.com /exploits/4572 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • osvdb.org /40079 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securitytracker.com /id?1018823 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • exploit-db.com /exploits/4570 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securityreason.com /securityalert/3245 · third-party-advisory, x_refsource_SREASON, x_transferred
  • secunia.com /advisories/27409 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/27251 · third-party-advisory, x_refsource_SECUNIA, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.