SQL Injection in Oracle Database Server
CVE-2007-5511
SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attackers to execute arbitrary SQL commands via the FINDRICSET procedure in the LT package. NOTE: this is probably covered by CVE-2007-5510, but there are insufficient details to be certain.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.5 (Medium). Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.318 (98.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.318 · newest: 0.318 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/archive/1/482429/100/0/threaded (mailing-list)
- www.vupen.com/english/advisories/2007/3524 (vdb-entry)
- www.securityfocus.com/bid/26098 (vdb-entry)
- www.vupen.com/english/advisories/2007/3626 (vdb-entry)
- www.exploit-db.com/exploits/4571 (exploit)
- marc.info/ (vendor-advisory)
- www.exploit-db.com/exploits/4572 (exploit)
- osvdb.org/40079 (vdb-entry)
- www.securitytracker.com/id (vdb-entry)
- www.exploit-db.com/exploits/4570 (exploit)
Frequently asked questions
- What is CVE-2007-5511?
- CVE-2007-5511 is a vulnerability in Oracle Database Server, classified under SQL Injection. Published 2007-10-17.
- Is CVE-2007-5511 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.