Published: 27/04/2006 Updated: 18/10/2018

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

VMScore: 470

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the DBMS_EXPORT_EXTENSION package. NOTE: this issue was originally linked to DB05 (CVE-2006-1870), but a reliable third party has claimed that it is not the same issue. Based on details of the problem, the primary issue appears to be insecure privileges that facilitate the introduction of SQL in a way that is not related to special characters, so this is not "SQL injection" per se.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle database server

/* 0day, description is wrong /str0ke */ /* * Fucking NON-0 day($) exploit for Oracle 10g 102020 * * Patch your database now! * * by N1V1Hd $3c41r3 * */ CREATE OR REPLACE PACKAGE MYBADPACKAGE AUTHID CURRENT_USER IS FUNCTION ODCIIndexGetMetadata (oindexinfo SYSodciindexinfo,P3 VARCHAR2,p4 VARCHAR2,env SYSodcienv) RETURN NUMBER; END; / CREA ...

#!/usr/bin/perl # # Remote Oracle dbms_export_extension exploit (any version) # Grant or revoke dba permission to unprivileged user # # Tested on Oracle 10g - Release 102010 # Oracle 9i - Release 92020 # # REF: wwwsecurityfocuscom/bid/17699 # # AUTHOR: Andrea "bunker" Purificato # rawlabmindcreation ...

NVD-CWE-Other http://www.red-database-security.com/exploits/oracle-sql-injection-oracle-dbms_export_extension.html http://www.kb.cert.org/vuls/id/932124 http://www.securityfocus.com/bid/17699 http://securitytracker.com/id?1015999 http://secunia.com/advisories/19860 http://securityreason.com/securityalert/802 https://exchange.xforce.ibmcloud.com/vulnerabilities/26048 http://www.securityfocus.com/archive/1/432632/30/5250/threaded http://www.securityfocus.com/archive/1/432355/100/0/threaded http://www.securityfocus.com/archive/1/432354/100/0/threaded http://www.securityfocus.com/archive/1/432078/100/0/threaded http://www.securityfocus.com/archive/1/431353/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/1719/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2006-2081

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect