The Metasploit Project hosts the world's largest database of quality assured exploits, including hundreds of remote exploits, auxiliary modules, and payloads. You can even review the Metasploit Framework source code of any module - or write your own.

Search for modules

Oracle DB SQL Injection via SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION

This module will escalate a Oracle DB user to DBA by exploiting an sql injection bug in the SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION package/function. This vulnerability affects to Oracle Database Server 9i up to 9.2.0.5 and 10g up to 10.1.0.4.

Rank

• Normal

Authors

• Esteban Martinez Fayo < >
• juan vazquez < >

References

• CVE-2005-4832
• BID-13236
• OSVDB-15553
• http://www.appsecinc.com/resources/alerts/oracle/2005-02.html
• http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txt

Development

• Source Code
• History

Similar Modules

• auxiliary/sqli/oracle/dbms_cdc_ipublish
• auxiliary/sqli/oracle/dbms_cdc_publish
• auxiliary/sqli/oracle/dbms_cdc_publish2
• auxiliary/sqli/oracle/dbms_cdc_publish3
• auxiliary/sqli/oracle/dbms_export_extension
• auxiliary/sqli/oracle/dbms_metadata_get_granted_xml
• auxiliary/sqli/oracle/dbms_metadata_get_xml
• auxiliary/sqli/oracle/dbms_metadata_open
• auxiliary/sqli/oracle/droptable_trigger
• auxiliary/sqli/oracle/jvm_os_code_10g

Usage Information

Module Options