Oracle Enterprise Manager Grid Control CVE-2013-0372 SQL Injection Vulnerability

Bugtraq ID:	57378
Class:	Input Validation Error
CVE:	CVE-2013-0372
Remote:	Yes
Local:	No
Published:	Jan 15 2013 12:00AM
Updated:	Feb 27 2014 12:31PM
Credit:	Esteban Martinez Fayo of Application Security Inc
Vulnerable:
Not Vulnerable:

Oracle Enterprise Manager Grid Control CVE-2013-0372 SQL Injection Vulnerability

Oracle Enterprise Manager Grid Control is prone to an SQL-injection vulnerability.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This vulnerability affects the following supported versions:
EM Base Platform: 11.1.0.1, 12.1.0.1; EM DB Control: 11.1.0.7, 11.2.0.2, 11.2.0.3; EM Plugin for DB: 12.1.0.2

Oracle Enterprise Manager Grid Control CVE-2013-0372 SQL Injection Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to follow a malicious URI.

Oracle Enterprise Manager Grid Control CVE-2013-0372 SQL Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oracle Enterprise Manager Grid Control CVE-2013-0372 SQL Injection Vulnerability

References:

• Oracle Homepage (Oracle)