Oracle 10g MDSYS.SDO_TOPO_DROP_FTBL SQL Injection Exploit (meta)

Exploit for multiple platform in category local exploits ================================================================ Oracle 10g MDSYS.SDOTOPODROPFTBL SQL Injection Exploit meta ================================================================ $Id: droptabletrigger.rb This file is part of the...

Oracle AS Portal Cross Site Scripting

Oracle AS Portal is a Web-based application for building and deploying portals. It provides a secure, manageable environment for accessing and interacting with enterprise software services and information resources. A vulnerability has been identified in Oracle Application Server 10g, This could ...

Oracle 10g SYS.LT.COMPRESSWORKSPACETREE SQL Injection Exploit

No description provided by source. // /Oracle 10g SYS.LT.COMPRESSWORKSPACETREE SQL Injection Exploit/ /grant DBA and create new OS user using scheduller/ // /exploit grant DBA to scott/ /and execute OS command "net user"/ /using scheduler/ // /tested on oracle 10.1.0.5.0/ // // / Date of Public...

Oracle 10g SYS.LT.REMOVEWORKSPACE SQL Injection Exploit

No description provided by source. // /Oracle 10g SYS.LT.REMOVEWORKSPACE SQL Injection Exploit/ /grant DBA and create new OS user advanced extproc/ // /exploit grant DBA to scott/ /and execute OS command "net user"/ /using advanced extproc method/ // /tested on oracle 10.1.0.5.0/ // // / Date of...

Oracle 10g SYS.LT.COMPRESSWORKSPACETREE SQL Injection Exploit

// /Oracle 10g SYS.LT.COMPRESSWORKSPACETREE SQL Injection Exploit/ /grant DBA and create new OS user using scheduller/ // /exploit grant DBA to scott/ /and execute OS command "net user"/ /using scheduler/ // /tested on oracle 10.1.0.5.0/ // // / Date of Public EXPLOIT: January 6, 2009 / / Written...

Oracle 10g SYS.LT.MERGEWORKSPACE SQL Injection Exploit

No description provided by source. // /Oracle 10g SYS.LT.MERGEWORKSPACE SQL Injection Exploit/ /grant DBA and create new OS user java/ // /exploit grant DBA to scott/ /and execute OS command "net user"/ /using java procedures / // /tested on oracle 10.1.0.5.0/ // // / Date of Public EXPLOIT:...

Oracle 10g SYS.LT.MERGEWORKSPACE SQL Injection Exploit

// /Oracle 10g SYS.LT.MERGEWORKSPACE SQL Injection Exploit/ /grant DBA and create new OS user java/ // /exploit grant DBA to scott/ /and execute OS command "net user"/ /using java procedures / // /tested on oracle 10.1.0.5.0/ // // / Date of Public EXPLOIT: January 6, 2009 / / Written by: Alexand...

Oracle 10g - SYS.LT.REMOVEWORKSPACE SQL Injection

Oracle 10g - SYS.LT.REMOVEWORKSPACE SQL Injection // /Oracle 10g SYS.LT.REMOVEWORKSPACE SQL Injection Exploit/ /grant DBA and create new OS user advanced extproc/ // /exploit grant DBA to scott/ /and execute OS command "net user"/ /using advanced extproc method/ // /tested on oracle 10.1.0.5.0/ /...

Oracle 10g SYS.LT.REMOVEWORKSPACE SQL Injection Exploit

Exploit for multiple platform in category local exploits ======================================================= Oracle 10g SYS.LT.REMOVEWORKSPACE SQL Injection Exploit ======================================================= // /Oracle 10g SYS.LT.REMOVEWORKSPACE SQL Injection Exploit/ /grant DBA...

Oracle 10g - SYS.LT.REMOVEWORKSPACE SQL Injection

// /Oracle 10g SYS.LT.REMOVEWORKSPACE SQL Injection Exploit/ /grant DBA and create new OS user advanced extproc/ // /exploit grant DBA to scott/ /and execute OS command "net user"/ /using advanced extproc method/ // /tested on oracle 10.1.0.5.0/ // // / Date of Public EXPLOIT: January 6, 2009 / /...

Oracle 10g - 'SYS.LT.COMPRESSWORKSPACETREE' SQL Injection (1)

// /Oracle 10g SYS.LT.COMPRESSWORKSPACETREE SQL Injection Exploit/ /grant DBA and create new OS user using scheduller/ // /exploit grant DBA to scott/ /and execute OS command "net user"/ /using scheduler/ // /tested on oracle 10.1.0.5.0/ // // / Date of Public EXPLOIT: January 6, 2009 / / Written...

Oracle 10g - SYS.LT.MERGEWORKSPACE SQL Injection

// /Oracle 10g SYS.LT.MERGEWORKSPACE SQL Injection Exploit/ /grant DBA and create new OS user java/ // /exploit grant DBA to scott/ /and execute OS command "net user"/ /using java procedures / // /tested on oracle 10.1.0.5.0/ // // / Date of Public EXPLOIT: January 6, 2009 / / Written by: Alexand...

Oracle 10g SYS.LT.COMPRESSWORKSPACETREE SQL Injection Exploit

Exploit for multiple platform in category local exploits ============================================================= Oracle 10g SYS.LT.COMPRESSWORKSPACETREE SQL Injection Exploit ============================================================= // /Oracle 10g SYS.LT.COMPRESSWORKSPACETREE SQL...

Oracle 10g - SYS.LT.COMPRESSWORKSPACETREE SQL Injection (1)

Oracle 10g - SYS.LT.COMPRESSWORKSPACETREE SQL Injection 1 // /Oracle 10g SYS.LT.COMPRESSWORKSPACETREE SQL Injection Exploit/ /grant DBA and create new OS user using scheduller/ // /exploit grant DBA to scott/ /and execute OS command "net user"/ /using scheduler/ // /tested on oracle 10.1.0.5.0/ /...

Oracle 10g SYS.LT.MERGEWORKSPACE SQL Injection Exploit

Exploit for multiple platform in category local exploits ====================================================== Oracle 10g SYS.LT.MERGEWORKSPACE SQL Injection Exploit ====================================================== // /Oracle 10g SYS.LT.MERGEWORKSPACE SQL Injection Exploit/ /grant DBA and...

CVE-2008-2625: Oracle DBMS – Proxy Authentication Vulnerability

Oracle is a widely-deployed Database Management System DBMS that supports a variety of applications. Many multi-tier applications are designed to use proxy authentication, restricting a middle tier to establish the database connection on behalf of the users. The standard authentication mechanism...

Oracle 10g DBMS_EXPORT_EXTENSION存储过程远程SQL注入漏洞

Oracle是一款大型的商业数据库系统。 Oracle 10g中由SYS用户运行的DBMSEXPORTEXTENSION存储过程存在PL/SQL注入漏洞，允许低权限用户以DBA权限执行任意SQL代码。 Oracle声称已在2006年4月的紧急补丁更新中修复了这个漏洞，但实际上并未修复。 Oracle10g 10.2.0.2.0 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 删除DBMSEXPORTEXTENSION的PUBLIC执行权限。 厂商补丁： Oracle ------...

Oracle Database Server 'CREATE ANY DIRECTORY'特权提升漏洞

BUGTRAQ ID: 31738 CNCAN ID：CNCAN-2008101405 Oracle Database Server是一款大型企业级的数据库服务程序。 Oracle Database Server 'CREATE ANY DIRECTORY'用户特权相关处理存在问题，远程攻击者可以利用漏洞获得SYSDBA特权权限。 通过UTLDIR使用已知两进制密码文件可直接覆盖隐藏的两进制文件，而使拥有CREATE ANY DIRECTORY低权限的用户获得SYSDBA特权。 目前如下链接进行了一定程度的分析目前不能连接：...

Design/Logic Flaw

Oracle Application Server OracleAS Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /davportal/portal/ by sending a request containing a trailing "%0A" encoded line feed, then using the session ID that is generated from that request. NOTE: as of...

CVE-2008-2138

Oracle Application Server Portal 10g is affected by an authentication bypass vulnerability (CVE-2008-2138) where an unauthenticated attacker can read files under /dav_portal/portal by sending a crafted GET request containing a trailing %0A and then reusing the session ID generated from that reque...