Loading vulnerability…
A stack-based buffer overflow vulnerability exists in the XML Database (XDB) functionality of Oracle 9i Database Release 2 (9.2.0.1), affecting both Windows and Linux platforms. The vulnerability can be triggered by sending overly long usernames, passwords, or parameters to certain FTP commands (such as UNLOCK) or via HTTP requests to the XDB service. Exploitation allows an attacker to overwrite the saved return address on the stack, leading to arbitrary code execution within the context of the XDB service process. The vulnerability requires valid credentials to authenticate to the XDB service before exploitation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository contains a single Metasploit module targeting a stack-based buffer overflow vulnerability in the Oracle 9i XML Database (XDB) FTP service (CVE-2003-0727). The exploit works by sending an overly long argument to the FTP 'UNLOCK' command, causing a buffer overflow and allowing arbitrary code execution. The module is written in Ruby and leverages Metasploit's framework for payload delivery and session handling. It requires valid FTP credentials (default: dbsnmp/dbsnmp) and targets the service on TCP port 2100. The payload is customizable (up to 800 bytes) and can be used to gain remote code execution on the affected Windows system. The repository is structured as a typical Metasploit exploit module, with all logic contained in a single Ruby file.
This repository contains a single Metasploit module targeting a stack-based buffer overflow vulnerability in the Oracle 9i XML Database (XDB) FTP service (CVE-2003-0727) on Windows. The exploit works by sending an overly long string to the FTP PASS command, causing a buffer overflow and allowing arbitrary code execution. The module is weaponized, supporting customizable payloads via the Metasploit framework. The default target is Oracle 9.2.0.1 Universal on Windows, with the FTP service running on TCP port 2100. The code includes a check method to identify vulnerable versions based on the FTP banner. The exploit is reliable and can be used to gain remote access to the target system with the privileges of the Oracle XDB service. The repository is structured as a single Ruby file compatible with Metasploit, and all exploit logic is contained within this file.
This repository contains a single Metasploit module (modules/exploits/windows/http/oracle9i_xdb_pass.rb) that exploits a stack buffer overflow vulnerability (CVE-2003-0727) in the Oracle 9i XML Database (XDB) HTTP service on Windows (version 9.2.0.1). The exploit targets the HTTP Basic Authorization header, sending a specially crafted value to overflow the stack and execute arbitrary code. The module allows the attacker to deliver a customizable Metasploit payload (up to 400 bytes, avoiding null bytes), resulting in code execution with the privileges of the Oracle XDB service. The default target port is TCP 8080, and the exploit is triggered via an HTTP GET request to the root path ('/'). The module includes a check method to verify if the target is running the vulnerable version. The repository is structured as a typical Metasploit exploit module, written in Ruby, and is operational with customizable payload support.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.