CVE-2010-2415

Related Files

Oracle DB SQL Injection Via SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET

Posted Aug 31, 2024

Authored by Jay Turla | Site metasploit.com

The module exploits an sql injection flaw in the CREATE_CHANGE_SET procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege on the vulnerable package can exploit this vulnerability. By default, users granted EXECUTE_CATALOG_ROLE have the required privilege.

tags | exploit, sql injection

advisories | CVE-2010-2415

SHA-256 | 26ed86f78f01db48be7f14a8b9f1b9fec76717709540eee30aa0dfa68088569f

Download | Favorite | View

Oracle Database CREATE_CHANGE_SET SQL Injection

Posted Oct 15, 2010

Authored by Esteban Martinez Fayo | Site appsecinc.com

Team SHATTER Security Advisory - Oracle Database provides the DBMS_CDC_PUBLISH PL/SQL package owned by SYS that is part of the Change Data Capture component. This package has a SQL Injection vulnerability in CREATE_CHANGE_SET procedure. A malicious user can call the vulnerable procedure of this package with specially crafted parameters and execute SQL statements with the elevated privileges of the SYS user.

tags | advisory, sql injection

advisories | CVE-2010-2415

SHA-256 | a4826476bad8dd89e0725984586be712f1bfa2620f4faad2b0e241fb72a4af3a

Download | Favorite | View