CVE-2006-1866 SQL injection in n/a
SQL injection in Oracle Spatial catalog functions allows attackers to read or modify data, requiring database access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-1866?
CVE-2006-1866 is a critical SQL injection vulnerability in Oracle Database Server, published on 20 Apr 2006. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple unspecified vulnerabilities in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and other versions have unknown impact and attack vectors in the (1) Advanced Replication component, as identified by Vuln# DB01, and (2) Oracle Spatial component, as identified by Vuln# DB10. NOTE: details are unavailable from Oracle, but as of 20060421, they have not publicly disputed a claim by a reliable independent researcher that states that DB01 is an unknown issue in the DBMS_REPUTIL package, and DB10 is SQL injection in the INSERT_CATALOG, UPDATE_CATALOG, and DELETE_CATALOG functions of the SDO_CATALOG package.
Which versions are affected by CVE-2006-1866?
It affects 1 product.
Products include Oracle Database Server.
How do I fix CVE-2006-1866?
No fix has been published for CVE-2006-1866 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2006-1866 being exploited?
There is no known exploitation of CVE-2006-1866 in the wild and no public exploit code.
Other vulnerabilities in Oracle Database Server
Sources
Also known as GHSA-49c4-99cj-3v65.