30 June 2006, 08:32
In a security advisory, Alexander Kornbrust has reported on a common programming error in Oracle Reports that allows arbitrary database queries to be injected (SQL injections).
Reports that use what are called "lexical references" are affected. If the expression ¶mform=yes is added to the URL of such reports, a new browser window opens up where the SQL query can be changed easily. In the advisory, a number of examples of improper implementations are provided along with proposed solutions to work around this problem.
Kornbrust believes that such reports with lexical references are very popular because they are so powerful.
- Security Advisory of Red Database Security
Print Version
| Permalink: http://h-online.com/-746507
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
