The Metasploit Project hosts the world's largest database of quality assured exploits, including hundreds of remote exploits, auxiliary modules, and payloads. You can even review the Metasploit Framework source code of any module - or write your own.

Search for modules

Oracle DB SQL Injection via SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE

The module exploits an sql injection flaw in the ALTER_HOTLOG_INTERNAL_CSOURCE procedure of the PL/SQL package DBMS_CDC_IPUBLISH. Any user with execute privilege on the vulnerable package can exploit this vulnerability. By default, users granted EXECUTE_CATALOG_ROLE have the required privilege. Affected versions: Oracle Database Server versions 10gR1, 10gR2 and 11gR1. Fixed with October 2008 CPU.

Rank

• Normal

Authors

• MC < mc [at] metasploit.com >

References

• CVE-2008-3996
• OSVDB-49321
• http://www.appsecinc.com/resources/alerts/oracle/2008-08.shtml

Development

• Source Code
• History

Similar Modules

• auxiliary/sqli/oracle/dbms_cdc_publish
• auxiliary/sqli/oracle/dbms_cdc_publish2
• auxiliary/sqli/oracle/dbms_cdc_publish3
• auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription
• auxiliary/sqli/oracle/dbms_export_extension
• auxiliary/sqli/oracle/dbms_metadata_get_granted_xml
• auxiliary/sqli/oracle/dbms_metadata_get_xml
• auxiliary/sqli/oracle/dbms_metadata_open
• auxiliary/sqli/oracle/droptable_trigger
• auxiliary/sqli/oracle/jvm_os_code_10g

Usage Information

Module Options