###########################################################

Name		SQL Injection Vulnerability in Oracle WWV_FLOW_UTILITIES
Systems 	Affected Oracle APEX/HTMLDB
Severity   	High Risk
Category   	SQL Injection
Vendor URL 	http://www.oracle.com/ 
Author 	        Alexander Kornbrust (ak at red-database-security.com)
Date 	      18 October 2006 (V 1.00)
Advisory http://www.red-database-security.com/advisory/oracle_apex_sql_injection_wwv_flow_utilities.html 

Details
#######
The list of values (LOV) in wwv_flow_utilities.gen_popup_list contains a SQL 
injection vulnerability. Depending of the APEX application it is possible 
to inject custom SQL statements. The entire SQL statement is accessible from 
the URL in the parameter P_LOV. To protect the SELECT statement in the URL 
Oracle is using a MD5 checksum. By modifying the SQL statement and recalculating 
the MD5 checksum P_LOV_CHECKSUM it is possible to run custom SQL statements 
from the URL.

Sample URL:
http://apex:7777/pls/htmldb/wwv_flow_utilities.gen_popup_list?p_filter=&p_name=p_t02&p_element_index=1&p_hidden_elem_name=p_t01&p_form_index=0&p_max_elements=&p_escape_html=&p_ok_to_query=YES&p_flow_id=100&p_page_id=11&p_session_id=15108399238201864297&p_eval_value=&p_return_key=YES&p_translation=N&p_lov=select%20cust_last_name%20||%20'%2C%20'%20||%20cust_first_name%20d%2C%20customer_id%20r%20from%20demo_customers%20order%20by%20cust_last_name&p_lov_checksum=82C7EFB6FA3A2FA2C6E1A70FB63BB064 



Affected Products
#################
This bug is fixed with 2.2 of APEX which is not part of the Critical Patch 
Update October 2006. It's necessary to upgrade your APEX/HTMLDB installation 
to 2.2 or better 2.2.1.

Patches are currently not available for Oracle Application Express.

Patch Information
#################
This bug is fixed with Apex 2.2 or higher.



History
#######
03-oct-2005 Oracle secalert was informed
04-oct-2005 Bug confirmed
17-oct-2006 Oracle published CPU October 2006 and recommends to update to 2.2.1
18-oct-2006 Red-Database-Security published this advisory


Additional Information
######################
An analysis of the Oracle CPU Oct 2006 is available here http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html