type: incident · created: 2026-08-06 · updated: 2026-08-06 · tags: [incident, sql-injection, oracle, rce, huntress, living-in-db] · confidence: high · affected_sectors: [technology, finance, government] · au_impact: true
Attackers Compile 'khunt' Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Huntress documented an intrusion where attackers used a SQL injection flaw in a public-facing web application to reach an Oracle database, then fed Java source code to the database so Oracle compiled it into stored schema objects and ran commands from inside the database engine — achieving SYSTEM-level code execution without writing an executable to disk.
| Attribute | Detail |
|---|---|
| Vector | SQL injection in public-facing web app |
| Technique | Compile-and-run Java inside Oracle (stored schema objects) |
| Result | SYSTEM-level code execution, no executable written to disk |
| Flaw location | Unvalidated autocomplete search field over a JDBC connection with Java-object-create privilege |
| Remediation | No Oracle patch closes the app flaw or the account privilege |
| Source | Huntress (via The Hacker News) — Tier 2/4 |
The intrusion is a "living-in-the-database" technique — turning the DB engine itself into the code-execution primitive and evading file-based detection.