SQL Injection On FundTransferDetailsOBPMAPI
(Doc ID 3064571.1)
Last updated on DECEMBER 30, 2024
Applies to:
Oracle Banking Payments - Version 14.7.0.0.0 and laterInformation in this document applies to any platform.
Symptoms
Description:
SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
Analysis:
During assessment, it was found that “networkCode” parameter on “/fundtransferdetails-Commfetch” endpoint is vulnerable to SQL Injection attack. Attacker can send crafted user input to access sensitive the data present in backend database.
Cause
To view full details, sign in with your My Oracle Support account. |
|
Don't have a My Oracle Support account? Click to get started! |
In this Document
| Symptoms |
| Cause |
| Solution |
| References |