Vulnerability Name:

CVE-2002-1631 (CCN-8665)

Assigned:2002-01-10
Published:2002-01-10
Updated:2008-09-05
Summary:SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2002-1631

Source: MITRE
Type: CNA
CVE-2002-1632

Source: CCN
Type: Oracle Security Alert #28
Vulnerabilities in Oracle mod_plsql and JSP in Oracle9i Application Server, v1.0.2.x

Source: CCN
Type: US-CERT VU#717827
Multiple Oracle 9iAS sample pages contain vulnerabilities

Source: CERT-VN
Type: Patch, US Government Resource
VU#717827

Source: CONFIRM
Type: US Government Resource
http://www.kb.cert.org/vuls/id/SVIM-576QLZ

Source: CCN
Type: NGSSoftware Insight Security Research Paper
Hackproofing Oracle Application Server

Source: MISC
Type: Exploit, Patch
http://www.nextgenss.com/papers/hpoas.pdf

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf

Source: CCN
Type: OSVDB ID: 18215
Oracle 9iAS info.jsp Sample Application Information Disclosure

Source: CCN
Type: OSVDB ID: 18216
Oracle 9iAS printenv Sample Application Information Disclosure

Source: CCN
Type: OSVDB ID: 18217
Oracle 9iAS echo Sample Application Information Disclosure

Source: CCN
Type: OSVDB ID: 18218
Oracle 9iAS echo2 Sample Application Information Disclosure

Source: CCN
Type: OSVDB ID: 509
Oracle XSQL query.xsql sql Parameter SQL Injection

Source: BID
Type: UNKNOWN
6556

Source: CCN
Type: BID-6556
Oracle 9i Application Server Sample Scripts Information Disclosure Vulnerability

Source: XF
Type: UNKNOWN
oracle-appserver-info-sample(8665)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:oracle:application_server:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:1.0.2.1s:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.2.0.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:oracle:application_server:9.0.2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:1.0.2.1s:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:1.0.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.2.0.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    oracle application server 1.0.2
    oracle application server 1.0.2.1s
    oracle application server 1.0.2.2
    oracle application server 9.0.2.0.0
    oracle application server 9.0.2.0.1
    oracle application server 9.0.2.0.0
    oracle application server 1.0.2.2
    oracle application server 1.0.2.1s
    oracle application server 1.0.2.0
    oracle application server 9.0.2.0.1