Oracle Enterprise Manager Grid Control CVE-2013-0374 Multiple SQL Injection Vulnerabilities

Bugtraq ID:	57368
Class:	Unknown
CVE:	CVE-2013-0374
Remote:	Yes
Local:	No
Published:	Jan 15 2013 12:00AM
Updated:	Feb 25 2013 05:03PM
Credit:	Esteban Martínez Fayó of Application Security Inc.
Vulnerable:
Not Vulnerable:

Oracle Enterprise Manager Grid Control CVE-2013-0374 Multiple SQL Injection Vulnerabilities

Oracle Enterprise Manager Grid Control is prone to multiple SQL-injection vulnerabilities.

The vulnerability can be exploited over the 'HTTP' protocol. The 'Database Cloning' sub component is affected.

An attacker can exploit these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This vulnerability affects the following supported versions:

EM Base Platform: 10.2.0.5, 11.1.0.1
EM DB Control: 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3
EM Plugin for DB: 12.1.0.1, 12.1.0.2

Oracle Enterprise Manager Grid Control CVE-2013-0374 Multiple SQL Injection Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle Enterprise Manager Grid Control CVE-2013-0374 Multiple SQL Injection Vulnerabilities

Solution:
Vendor updates are available. Please contact the vendor for more information.

Oracle Enterprise Manager Grid Control CVE-2013-0374 Multiple SQL Injection Vulnerabilities

References:

• Oracle Homepage (Oracle)