Vulnerabilities > CVE-2006-2081 - SQL Injection vulnerability in Oracle 10g DBMS_EXPORT_EXTENSION

047910
CVSS 4.6 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
local
low complexity
oracle
exploit available
metasploit
NVD
Published: 2006-04-27
Updated: 2018-10-18

Summary

Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the DBMS_EXPORT_EXTENSION package. NOTE: this issue was originally linked to DB05 (CVE-2006-1870), but a reliable third party has claimed that it is not the same issue. Based on details of the problem, the primary issue appears to be insecure privileges that facilitate the introduction of SQL in a way that is not related to special characters, so this is not "SQL injection" per se.

Vulnerable Configurations

Part Description Count
Application
Oracle
1

Exploit-Db

  • descriptionOracle <= 10g Release 2 (DBMS_EXPORT_EXTENSION) Local SQL Exploit. CVE-2006-2081,CVE-2006-2505. Local exploits for multiple platform
    idEDB-ID:1719
    last seen2016-01-31
    modified2006-04-26
    published2006-04-26
    reporterN1V1Hd
    sourcehttps://www.exploit-db.com/download/1719/
    titleOracle <= 10g Release 2 DBMS_EXPORT_EXTENSION Local SQL Exploit
  • descriptionOracle 9i/10g DBMS_EXPORT_EXTENSION SQL Injection Exploit. CVE-2006-2081,CVE-2006-2505. Remote exploits for multiple platform
    idEDB-ID:3269
    last seen2016-01-31
    modified2007-02-05
    published2007-02-05
    reporterbunker
    sourcehttps://www.exploit-db.com/download/3269/
    titleOracle 9i/10g DBMS_EXPORT_EXTENSION SQL Injection Exploit

Metasploit

descriptionThis module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_METADATA package. Note: This module has been tested against 9i, 10gR1 and 10gR2.
idMSF:AUXILIARY/SQLI/ORACLE/DBMS_EXPORT_EXTENSION
last seen2020-06-13
modified2017-08-29
published2010-03-25
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/sqli/oracle/dbms_export_extension.rb
titleOracle DB SQL Injection via DBMS_EXPORT_EXTENSION

References