CVE-2004-1339

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-12-23 · updated 2026-06-16
Weakness: CWE-89

Description

SQL injection vulnerability in the (1) MDSYS.SDO_GEOM_TRIG_INS1 and (2) MDSYS.SDO_LRS_TRIG_INS default triggers in Oracle 9i and 10g allows remote attackers to execute arbitrary SQL commands via the new.table_name or new.column_name parameters.

Affected products

Oracle Database: 10.2.1-r2
Oracle9I: 9.0, 9.0.1, 9.0.1.2, 9.0.1.3, 9.0.1.4, 9.0.2 (+7)

References

http://marc.info/?l=bugtraq&m=110382230614420&w=2
http://www.ngssoftware.com/advisories/oracle23122004I.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/18655
http://marc.info/?l=bugtraq&m=110382230614420&w=2
http://www.ngssoftware.com/advisories/oracle23122004I.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/18655

Get alerted when CVE-2004-1339 or the next vulnerability affects your stack