CVE-2007-5508 : Multiple SQL injection vulnerabilities in the CTXSYS Intermedia application for the Oracle Text component (CTX

Multiple SQL injection vulnerabilities in the CTXSYS Intermedia application for the Oracle Text component (CTX_DOC) in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) THEMES, (2) GIST, (3) TOKENS, (4) FILTER, (5) HIGHLIGHT, and (6) MARKUP procedures, aka DB03. NOTE: remote unauthenticated attack vectors exist when CTXSYS is used with oracle Application Server.

Published 2007-10-17 23:17:00

Updated 2018-10-15 21:45:32

Source MITRE

View at NVD, CVE.org

Vulnerability category: Sql Injection

Threat overview for CVE-2007-5508

Top countries where our scanners detected CVE-2007-5508

Top open port discovered on systems with this issue 1521

IPs affected by CVE-2007-5508 147

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2007-5508!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2007-5508

Probability of exploitation activity in the next 30 days: 0.59%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 78 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2007-5508

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2007-5508

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2007-5508

Products affected by CVE-2007-5508