SQL Injection in Oracle Forms
Short summary:
All Oracle Forms applications are vulnerable against SQL Injection by. default. ... About Oracle Forms: Oracle Forms 10g is Oracle's award winning Web Rapid ...
Long summary:
SQL Injection in Oracle Forms V1.01 © 2005 by Red-Database-Security GmbH 1/5 Summary: All Oracle Forms applications are vulnerable against SQL Injection by default. Oracle Applications >=11.5.9 is not affected due to the default setting value “FORMSxx_RESTRICT_ENTER_QUERY = TRUE”. (VU#718548) About Oracle Forms: Oracle Forms 10g is Oracles award winning Web Rapid Application Development tool, part of the Oracle Developer Suite 10g. It is a highly productive, end-to-end, PL/SQL based, development environment for building enterprise-class, database centric Internet applications. Oracle Application Server 10g provides out-of-the-box optimized Web deployment platform for Oracle Forms 10g. Oracle itself is using Oracle Forms for Oracle Applications. Affected products: All versions of Oracle Forms (3.0-10g, C/S and Web), Oracle Clinical, Oracle Developer Suite Fix: Set the undocumented environment variable FORMSxx_RESTRICT_ENTER_QUERY=true (FORMS60_RESTRICT_ENTER_QUERY for Forms 6.x, FORMS90_RESTRICT_ENTER_QUERY for Forms 9.x/10g) and restart the Forms server. This environment variable disables the possibility of using the query/where functionality. or only if really need Query/Where: Write a PRE_QUERY/ON-ERROR-trigger for EVERY input field and validate the entire input for EVERY Oracle Forms module (*.fmb) SQL Injection in Oracle Forms V1.01 © 2005 by Red-Database-Security GmbH 2/5 Background: There is an (ancient often forgotten) Oracle Forms feature called “Query/Where” which allows any user to modify existing SQL statements. This is a quite useful feature for power users but also dangerous because every forms user can execute any SQL statement. Short demonstration of SQL Injection 1. Start a Forms module and switch to the query mode and enter a colon (“:”) or ampersand (“&”) 2. An empty Query/Where windows pops up 3. Enter an SQL statement The following statement sends the result of the SQL statement “select username ...
Source: www.red-database-security.com
Related
Files under this topic are not filed yet. Please use search bar to find other one
