Hackers Exploit SQL Injection to Hijack Oracle Databases and Gain Full System Control

Security researchers at Huntress have uncovered a stealthy attack technique where hackers exploited a SQL injection vulnerability in a public-facing web application to break into an organization's Oracle database. Rather than downloading a traditional malicious program, the attackers fed Java source code directly into the database, letting Oracle itself compile it into stored objects within the database schema.

This approach allowed the attackers to run commands from inside the database engine itself, effectively turning a data-access flaw into a pathway for gaining Windows SYSTEM-level control—the highest level of access on a Windows machine. Because no executable file was ever written to disk, this method is designed to evade many traditional antivirus and endpoint detection tools that scan for suspicious files.

Huntress is tracking this post-exploitation toolkit under the name 'khunt'. The incident highlights how attackers are increasingly using built-in features of trusted software—like database compilers—to hide their activity and bypass conventional security defenses.