CVE-2006-2081 json
Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the…
published 2006-04-27 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-2082
- cvss
- 4.6
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 21.9%
- EPSS 21.9% chance of exploitation in 30 days, percentile 97%
- public exploits
- 3
- Metasploit, Exploit-DB
Summary
Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the DBMS_EXPORT_EXTENSION package. NOTE: this issue was originally linked to DB05 (CVE-2006-1870), but a reliable third party has claimed that it is not the same issue. Based on details of the problem, the primary issue appears to be insecure privileges that facilitate the introduction of SQL in a way that is not related to special characters, so this is not "SQL injection" per se.
Timeline
- First public exploit (Metasploit auxiliary/sqli/oracle/dbms_export_extension)
- Published
Exploit prediction
21.94% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/sqli/oracle/dbms_export_extension Oracle DB SQL Injection via DBMS_EXPORT_EXTENSION metasploit auxiliary, normal rank, 2006-04-26
- EDB-3269 Oracle 9i/10g - DBMS_EXPORT_EXTENSION SQL Injection remote, 2007-02-05
- EDB-1719 Oracle 10g Release 2 - 'DBMS_EXPORT_EXTENSION' SQL local, 2006-04-26
- red-database-security.com http://www.red-database-security.com/exploits/oracle-sql-injection-oracle-dbms_export_extension.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Technology feeds
References
-
red-database-security.com
/exploits/oracle-sql-injection-oracle-dbms_export_extension.html
exploit
-
securityfocus.com
/archive/1/432078/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/432354/100/0/threaded
mailing-list
-
kb.cert.org
/vuls/id/932124
third-party-advisory, us-government-resource
-
secunia.com
/advisories/19860
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/26048
vdb-entry
-
securityfocus.com
/archive/1/431353/100/0/threaded
mailing-list
-
securityfocus.com
/bid/17699
vdb-entry
-
securitytracker.com
/id?1015999
vdb-entry
-
securityfocus.com
/archive/1/432632/30/5250/threaded
mailing-list
-
securityreason.com
/securityalert/802
third-party-advisory
-
securityfocus.com
/archive/1/432355/100/0/threaded
mailing-list
Sources
- CVE List CVE-2006-2081
- NVD CVE-2006-2081
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.