CVE-2005-2372

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-07-26 · updated 2026-06-16

Description

Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.

Affected products

Oracle Corporation Oracle Forms: 3.0, 4.5, 5.0, 6.0, 6i, 9i (+1)

References

http://marc.info/?l=bugtraq&m=112180805413784&w=2
http://www.red-database-security.com/advisory/oracle_forms_run_any_os_command.html
http://marc.info/?l=bugtraq&m=112180805413784&w=2
http://www.red-database-security.com/advisory/oracle_forms_run_any_os_command.html

Get alerted when CVE-2005-2372 or the next vulnerability affects your stack