Oracle DB SQL Injection via SYS.LT.MERGEWORKSPACE
This module exploits an sql injection flaw in the MERGEWORKSPACE procedure of the PL/SQL package SYS.LT. Any user with execute privilege on the vulnerable package can exploit this vulnerability.
Rank
- Normal
Authors
- CG < cg [at] carnal0wnage.com >
Vulnerability References
- CVE-2008-3983
- OSVDB-49325
- http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoc...
- http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml
- http://www.dsecrg.com/pages/expl/show.php?id=23
Development
Similar Modules
- auxiliary/sqli/oracle/dbms_cdc_ipublish
- auxiliary/sqli/oracle/dbms_cdc_publish
- auxiliary/sqli/oracle/dbms_cdc_publish2
- auxiliary/sqli/oracle/dbms_cdc_publish3
- auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription
- auxiliary/sqli/oracle/dbms_export_extension
- auxiliary/sqli/oracle/dbms_metadata_get_granted_xml
- auxiliary/sqli/oracle/dbms_metadata_get_xml
- auxiliary/sqli/oracle/dbms_metadata_open
- auxiliary/sqli/oracle/droptable_trigger
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/sqli/oracle/lt_mergeworkspace
msf auxiliary(lt_mergeworkspace) > set RHOST [TARGET IP]
msf auxiliary(lt_mergeworkspace) > run
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/sqli/oracle/lt_mergeworkspace
msf auxiliary(lt_mergeworkspace) > set RHOST [TARGET IP]
msf auxiliary(lt_mergeworkspace) > run
Module Options
| DBPASS | The password to authenticate with. (default: TIGER) |
| DBUSER | The username to authenticate with. (default: SCOTT) |
| RHOST | The Oracle host. (default: ) |
| RPORT | The TNS port. (default: 1521) |
| SID | The sid to authenticate with. (default: ORCL) |
| SQL | SQL to execte. (default: GRANT DBA to SCOTT) |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
