EIP-2026-104025

PRE-CVE

Oracle 10g KUPM$MCP.MAIN - SQL Injection (2)

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104025. PoCs published by bunker.

AI-analyzed exploit summary This Perl script exploits a cursor injection vulnerability in Oracle Database 10g (CVE-2007-126999) to grant or revoke DBA privileges to an unprivileged user. It leverages the KUPM$MCP.MAIN procedure and DBMS_SQL.OPEN_CURSOR to execute arbitrary SQL commands without requiring CREATE PROCEDURE privileges.

Description

Oracle 10g KUPM$MCP.MAIN - SQL Injection (2)

Exploits (1)

exploitdb WORKING POC VERIFIED
by bunker · perlremotemultiple
https://www.exploit-db.com/exploits/3584

This Perl script exploits a cursor injection vulnerability in Oracle Database 10g (CVE-2007-126999) to grant or revoke DBA privileges to an unprivileged user. It leverages the KUPM$MCP.MAIN procedure and DBMS_SQL.OPEN_CURSOR to execute arbitrary SQL commands without requiring CREATE PROCEDURE privileges.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Oracle Database 10g Enterprise Edition Release 10.1.0.3.0
Auth required
Prerequisites: Valid Oracle database credentials · Network access to the Oracle database · Oracle InstantClient with DBD::Oracle
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026