Test ID:	10613
Category:	Web application abuses
Title:	Oracle XSQL Sample Application Vulnerability
Summary:	One of the sample applications that comes with; the Oracle XSQL Servlet allows an attacker to make arbitrary queries to; the Oracle database (under an unprivileged account).
Description:	Summary: One of the sample applications that comes with the Oracle XSQL Servlet allows an attacker to make arbitrary queries to the Oracle database (under an unprivileged account). Vulnerability Impact: Whilst not allowing an attacker to delete or modify database contents, this flaw can be used to enumerate database users and view table names. Solution: Sample applications should always be removed from production servers. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	BugTraq ID: 6556 Common Vulnerability Exposure (CVE) ID: CVE-2002-1630 http://www.securityfocus.com/bid/6556 CERT/CC vulnerability note: VU#717827 http://www.kb.cert.org/vuls/id/717827 http://www.nextgenss.com/papers/hpoas.pdf XForce ISS Database: oracle-appserver-sendmail-sample(8664) https://exchange.xforce.ibmcloud.com/vulnerabilities/8664 Common Vulnerability Exposure (CVE) ID: CVE-2002-1631 http://www.kb.cert.org/vuls/id/SVIM-576QLZ http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf Common Vulnerability Exposure (CVE) ID: CVE-2002-1632 XForce ISS Database: oracle-appserver-info-sample(8665) https://exchange.xforce.ibmcloud.com/vulnerabilities/8665
Copyright	Copyright (C) 2001 Matt Moore

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.