CVE-2008-3979

Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is a SQL injection vulnerability that allows remote authenticated users to gain MDSYS privileges via the MDSYS.SDO_TOPO_DROP_FTBL trigger.

CVSS v2.0

5.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N

EPSS

32.43% chance of exploitation in the next 30 days, 98th percentile

Published

2009-01-14

Updated

2024-08-07

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/sqli/oracle/droptable_trigger.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/8074

References

• CVE Record
• NVD entry

Related

• CVE-2008-3963
• CVE-2008-3982
• CVE-2008-3957
• CVE-2008-3983
• CVE-2008-3956
• CVE-2008-3984