HTTP: SQL Injection Detected on HTTP Request Variable 2

This signature detects specific characters, typically used in SQL procedures, within an HTTP connection. Because these characters are not normally used in HTTP, this can indicate a SQL injection attack through a procedure. However, it can be a false positive. To reduce False Positives, it is strongly recommended that these signatures only be used to inspect traffic from the Internet to your organization's web servers that use SQL backend databases to generate content and not to inspect traffic going from your organization to the Internet.

Extended Description

Unspecified vulnerability in the Oracle Human Resources component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to General utilities, a different vulnerability than CVE-2016-0518.

Affected Products

Oracle e-business_suite

References

BugTraq: 40430 39795 37938 45503 41058 22808 37703 68495

CVE: CVE-2018-6577

URL: http://seclists.org/fulldisclosure/2014/Jul/44 https://gist.github.com/brandonprry/76741d9a0d4f518fe297

Short Name

HTTP:SQL:INJ:REQ-VAR-2

Severity

Minor

Recommended

False

Recommended Action

None

HTTP: SQL Injection Detected on HTTP Request Variable 2

Extended Description

Affected Products

References

Found a potential security threat?