Vulnerability Details : CVE-2008-3979

Public exploit exists!
Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is a SQL injection vulnerability that allows remote authenticated users to gain MDSYS privileges via the MDSYS.SDO_TOPO_DROP_FTBL trigger.
Published 2009-01-14 01:30:00
Updated 2025-04-09 00:30:58
Source Oracle
View at NVD,   CVE.org
Vulnerability category: Sql Injection

Products affected by CVE-2008-3979

Exploit prediction scoring system (EPSS) score for CVE-2008-3979

EPSS FAQ
54.54%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2008-3979

  • Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger
    Disclosure Date: 2009-01-13
    First seen: 2020-04-26
    auxiliary/sqli/oracle/droptable_trigger
    This module will escalate an Oracle DB user to MDSYS by exploiting a sql injection bug in the MDSYS.SDO_TOPO_DROP_FTBL trigger. After that exploit escalate user to DBA using "CREATE ANY TRIGGER" privilege given to MDSYS user by creating evil trigger in system scheme (2

CVSS scores for CVE-2008-3979

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
5.5
 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:N
8.0
4.9
 NIST

References for CVE-2008-3979

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close