Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Forms | Oracle | 3.0 (including) | 3.0 (including) |
| Forms | Oracle | 4.5 (including) | 4.5 (including) |
| Forms | Oracle | 5.0 (including) | 5.0 (including) |
| Forms | Oracle | 6.0 (including) | 6.0 (including) |
| Forms | Oracle | 6i (including) | 6i (including) |
| Forms | Oracle | 9i (including) | 9i (including) |
| Forms | Oracle | 10g (including) | 10g (including) |