Loading feed…
IT Security Guru0 Hot0 comments4 min read
Hackers Smuggle Post-Exploitation Toolkit Into Oracle Database Via Classic SQL Injection Flaw
Threat actors exploited a SQL injection flaw in a public-facing web application to gain access to an Oracle database, then abused Oracle's CREATE JAVA SOURCE feature to upload and compile a custom post-exploitation toolkit called 'khunt' directly inside the database engine. The toolkit included modules for OS command execution, credential extraction, file system browsing, and file decompression. Using the command-execution module, attackers achieved SYSTEM-level privileges on the underlying Windows server and extracted credential hives. Huntress warns that storing malicious code as database objects creates a blind spot for traditional endpoint security tools. Recommended defenses include input sanitization, query parameterization, and least-privilege database account configurations.
Source: https://www.itsecurityguru.org/2026/08/05/hackers-smuggle-post-exploitation-toolkit-into-oracle-database-via-classic-sql-injection-flaw. 8sync News only summarizes and links out; content copyright belongs to the authors and original sources.
