This host is running Oracle Portal Demo Organization Chart and is prone to sql injection vulnerability.

Successful exploitation will allow remote attackers to manipulate SQL queries by injecting arbitrary SQL code. Impact Level: Application

Apply the patch from below link, http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html

Input passed via the 'p_arg_values' parameter to /pls/portal/PORTAL_DEMO.ORG _CHART.SHOW is not properly sanitized before being used in a sql query.

Oracle Portal version 11.1.1.6.0 and prior.

Send a crafted exploit string via HTTP GET request and check whether it is able to read the database information or not.

• http://packetstormsecurity.com/files/123650
• http://seclists.org/fulldisclosure/2013/Oct/111
• http://secunia.com/advisories/55332
• http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
• http://www.osvdb.org/98469

---

Updated on 2015-03-25