CVE-2007-5511
Oracle Database Server - SQL Injection via Workspace Manager FINDRICSET Procedure
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2007-5511.
PoCs published by bunker, sh2kerr, CG, including Metasploit module auxiliary/sqli/oracle/lt_findricset_cursor.
AI-analyzed exploit summary This exploit leverages a cursor injection vulnerability in Oracle's SYS.LT.FINDRICSET procedure to grant or revoke DBA privileges to an unprivileged user. It uses DBMS_SQL to execute arbitrary SQL commands without requiring CREATE PROCEDURE privileges.
Description
SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attackers to execute arbitrary SQL commands via the FINDRICSET procedure in the LT package. NOTE: this is probably covered by CVE-2007-5510, but there are insufficient details to be certain.
Exploits (4)
This exploit leverages a cursor injection vulnerability in Oracle's SYS.LT.FINDRICSET procedure to grant or revoke DBA privileges to an unprivileged user. It uses DBMS_SQL to execute arbitrary SQL commands without requiring CREATE PROCEDURE privileges.
This exploit leverages a vulnerability in Oracle's SYS.LT.FINDRICSET function to grant or revoke DBA privileges to an unprivileged user. It creates an autonomous transaction function to execute the privilege modification, bypassing standard permission checks.
This exploit leverages SQL injection in Oracle 10g's LT.FINDRICSET procedure to execute arbitrary SQL commands, granting DBA privileges to the 'scott' user. It uses base64 encoding to evade IDS detection.
This Metasploit module exploits a SQL injection vulnerability in Oracle DB's SYS.LT.FINDRICSET package via an Evil Cursor technique to escalate privileges to DBA. It leverages DBMS_SQL to execute arbitrary SQL commands, tested on Oracle 10.1.0.3.0 through 10.1.0.5.0.