CVE-2006-2081

Oracle Database Server 10g Release 2 - Arbitrary SQL Query Execution via DBMS_EXPORT_EXTENSION GET_DOMAIN_INDEX_METADATA

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2006-2081. PoCs published by MC, including Metasploit module auxiliary/sqli/oracle/dbms_export_extension.

AI-analyzed exploit summary This Perl script exploits CVE-2006-2081 in Oracle Database by leveraging the DBMS_EXPORT_EXTENSION package to grant or revoke DBA privileges to an unprivileged user. It creates a malicious package that executes arbitrary SQL commands via the ODCIIndexGetMetadata function.

Description

Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the DBMS_EXPORT_EXTENSION package. NOTE: this issue was originally linked to DB05 (CVE-2006-1870), but a reliable third party has claimed that it is not the same issue. Based on details of the problem, the primary issue appears to be insecure privileges that facilitate the introduction of SQL in a way that is not related to special characters, so this is not "SQL injection" per se.

Exploits (3)

exploitdb WORKING POC
perlremotemultiple
https://www.exploit-db.com/exploits/3269

This Perl script exploits CVE-2006-2081 in Oracle Database by leveraging the DBMS_EXPORT_EXTENSION package to grant or revoke DBA privileges to an unprivileged user. It creates a malicious package that executes arbitrary SQL commands via the ODCIIndexGetMetadata function.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Oracle Database 9i (9.2.0.2.0) and 10g (10.2.0.1.0)
Auth required
Prerequisites: Valid Oracle database credentials · Oracle InstantClient with DBD::Oracle
devstral-2 · analyzed Feb 19, 2026 Full analysis →
exploitdb WORKING POC
localmultiple
https://www.exploit-db.com/exploits/1719

This exploit leverages a privilege escalation vulnerability in Oracle 10g by creating a malicious package that grants DBA privileges to an attacker-controlled user. It abuses the `ODCIIndexGetMetadata` function and `DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_METADATA` to execute arbitrary SQL commands with elevated privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Oracle Database 10g 10.2.0.2.0
Auth required
Prerequisites: Valid database credentials · Ability to execute PL/SQL code
devstral-2 · analyzed Feb 19, 2026 Full analysis →
metasploit WORKING POC
by MC · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/sqli/oracle/dbms_export_extension.rb

This Metasploit module exploits a SQL injection vulnerability in Oracle DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_METADATA to escalate privileges to DBA. It creates a malicious package and executes arbitrary SQL commands via base64-encoded payloads.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Oracle Database 9i, 10gR1, 10gR2
Auth required
Prerequisites: Valid Oracle DB credentials · Access to execute PL/SQL
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (12)

Core 12
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/26048
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/432078/100/0/threaded
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/432354/100/0/threaded
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/932124
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19860
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/431353/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/17699
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1015999
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/432632/30/5250/threaded
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/802
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/432355/100/0/threaded

Scores

EPSS 0.6425
EPSS Percentile 98.5%

Details

Status published
Products (1)
oracle/database_server
Published Apr 27, 2006
Tracked Since Feb 18, 2026