• Please do not vote more than once per resource
• Please submit a variety of ratings so that resources get ratings other than just 1's and 10's

Oracle 9iAS XSQL Servlet File Permission Bypass Vulnerability

Oracle 9iAS package includes the XSQL Servlet as part of the XML Development kit. It may be used to convert the response from an SQL query into an XML format. Reportedly, the servlet does not properly enforce file permissions. An attacker may be able to exploit this vulnerability to view sensitive system configuration files, similar to the issues discussed in BID 4290.

http://www.xatrix.org/article1250.html