---
id: 8158
title: "Anonymous SQL Execution in Oracle Advanced Support"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/web-application-pentesting/anonymous-sql-execution-oracle-advanced-support/"
published_at: "2017-07-05T00:00:00Z"
tags: ["web-security", "penetration-testing", "oracle", "unauthenticated", "sql-execution"]
phying_url: "https://phying.com/item/8158"
lang: en
---

# Anonymous SQL Execution in Oracle Advanced Support

## Summary

An exposed JavaScript file on an Oracle Advanced Support server revealed unauthenticated REST endpoints under /rest/data/ that executed arbitrary SQL, uncovered through external pentest recon.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2017-07-05T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/web-application-pentesting/anonymous-sql-execution-oracle-advanced-support/
- **Phying News:** https://phying.com/item/8158