"Oracle's RDBMS, a leading database server package, supports stored packages and procedures through the use of PL/SQL. These packages and procedures can be accessed through Oracle's Application Server's Portal module. Oracle Application Server is a web server designed for Oracle applications. Many of the PL/SQL packages and procedures are vulnerable to SQL Injection. Using these vulnerabilities an unauthenticated attacker can gain access to all data in the database from the Internet." - ngssoftware.com

Full NGSSoftware Insight Security Advisory