[sqlmap-users] Oracle PL/SQL Stacked Queries Question

[Chris O. <chr...@gm...>]

Hi All

When I get an injection for an Oracle system on the back end, I can use
--sql-shell with no problems.  However, if I try to use stacked queries
here, I get an error message from SQLMap saying that I can't do that unless
stacked queries are enabled, which as far as I know you can't do with
Oracle, so that makes sense.

However, I've been reading and it seems (I could be wrong here, still
playing) that from 8i to 11g R2 there are packages which allow execution of
anonymous PL/SQL blocks - dbms_xmlquery.newcontext() and
dbms_xmlquery.getxml().  These are accessible to public by default.  So an
injection might be ?id=1 and (select dbms_xmlquery.newcontext('various;
stacked; queries;') from dual) is not null --  I've looked at SQLMaps
queries through a proxy and I don't think it does anything like this.
Again, I'm just reading up on this now so I could well be off base here.

Ultimately, I'm trying to use the injection to gain DBA privs.  I'm playing
around manually at the moment but wondered if this is something SQLMap
could potentially do and doesn't (or I'm totally wrong!)

Regards

Chris