CVE-2006-0551 SQL injection in n/a
Remote attackers can execute arbitrary SQL commands via the Data Pump Metadata API in Oracle Database, potentially compromising data integrity and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-0551?
CVE-2006-0551 is a high-severity SQL injection vulnerability in Oracle Database Server, published on 4 Feb 2006. It can be exploited over the network, with no action from the victim.
Official description
SQL injection vulnerability in the Data Pump Metadata API in Oracle Database 10g and possibly earlier might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB06 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0259 or, if it is DB05, subsumed by CVE-2006-0260.
Which versions are affected by CVE-2006-0551?
It affects 1 product.
Products include Oracle Database Server.
How do I fix CVE-2006-0551?
No fix has been published for CVE-2006-0551 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2006-0551 being exploited?
There is no known exploitation of CVE-2006-0551 in the wild and no public exploit code.
Other vulnerabilities in Oracle Database Server
Sources
Also known as GHSA-63c4-h6jq-3fj3.