Exploitation Summary
EIP tracks 5 public exploits for CVE-2005-4832.
PoCs published by bunker, Esteban Martinez Fayo, juan vazquez, including Metasploit module auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription.
AI-analyzed exploit summary This Perl script exploits CVE-2005-4832 in Oracle Database 9i/10g by leveraging cursor injection in the DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION procedure to grant or revoke DBA privileges without requiring CREATE PROCEDURE privileges. It uses DBD::Oracle to execute malicious SQL commands via an autonomous transaction.
Description
SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.
Exploits (5)
This Perl script exploits CVE-2005-4832 in Oracle Database 9i/10g by leveraging cursor injection in the DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION procedure to grant or revoke DBA privileges without requiring CREATE PROCEDURE privileges. It uses DBD::Oracle to execute malicious SQL commands via an autonomous transaction.
This Perl script exploits an SQL injection vulnerability in Oracle's DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION procedure (CVE-2005-4832) to grant or revoke DBA privileges to an unprivileged user. It leverages cursor injection to execute arbitrary SQL commands with SYS privileges.
This exploit leverages a vulnerability in Oracle's DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION to grant or revoke DBA privileges to an unprivileged user. It creates an autonomous transaction function to execute the privilege modification, bypassing standard authorization checks.
This Perl script exploits an SQL injection vulnerability in Oracle's DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION procedure (CVE-2005-4832) to grant or revoke DBA privileges to an unprivileged user. It leverages the SUBSCRIPTION_NAME parameter to execute arbitrary PL/SQL statements with SYS privileges.
This Metasploit module exploits a SQL injection vulnerability in Oracle DB's SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION to escalate privileges to DBA. It creates a malicious function, injects it via the vulnerable package, and cleans up afterward.