Oracle Database 11.2 SQLi in XML index statistics processing (CVE-2015-4900)

Posted on by

In the October 2015 ‘Critical Patch Update’ Oracle fixed a flaw in XML index support code: namely SQL injection which allows privilege escalation to DBA by unprivileged users. I reported this issue to Oracle back in April 2015 and 6…