CVE-2006-0549
Oracle Database Server - SQL Injection in SYS.DBMS_METADATA_UTIL
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-0549. PoCs published by bunker.
AI-analyzed exploit summary This Perl script exploits CVE-2006-0549 by leveraging cursor injection in Oracle's DBMS_METADATA.GET_DDL to grant or revoke DBA privileges without requiring CREATE PROCEDURE privileges. It uses DBD::Oracle to execute malicious SQL via an autonomous transaction, bypassing standard privilege checks.
Description
SQL injection vulnerability in the SYS.DBMS_METADATA_UTIL package in Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB05 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260. However, there are some inconsistencies that make this unclear, and there is also a possibility that this is related to DB06, which is subsumed by CVE-2006-0259.
Exploits (2)
This Perl script exploits CVE-2006-0549 by leveraging cursor injection in Oracle's DBMS_METADATA.GET_DDL to grant or revoke DBA privileges without requiring CREATE PROCEDURE privileges. It uses DBD::Oracle to execute malicious SQL via an autonomous transaction, bypassing standard privilege checks.
This Perl script exploits CVE-2006-0549 in Oracle Database 9i/10g by leveraging the DBMS_METADATA.GET_DDL function to grant or revoke DBA privileges to an unprivileged user. It creates an autonomous transaction function to bypass privilege checks and execute arbitrary SQL commands.