Advisory: XXE Injection in Oracle Database (CVE-2014-6577)

Cody Wass recounts discovering an XXE vulnerability in a service behind IBM's MaaS360 MDM platform, with a primer on external XML entities and how parser abuse enables file reads and SSRF.

A code review found 30 hardcoded database passwords across 20 accounts; the article shows how flaws like XXE turn leaked source into direct DB access and outlines safer secret distribution options.

By switching a JSON request's Content-Type to application/xml, testers can sometimes reach an unanticipated XML parser on the server and trigger XXE, enabling file reads, UNC access, or SSRF.

CVE-2026-21962 (CVSS 10.0) lets unauthenticated attackers bypass security in Oracle HTTP Server and WebLogic proxy plugins for Apache and IIS, exposing backend WebLogic systems in the DMZ.

Open-sources NetSPI's SQL injection wiki, a consolidated knowledge base spanning detection through attack queries across DBMSs, covering data extraction, obfuscation, and pivoting past the DB.

Argues production databases deserve care during pentests and shows read-only SQL injection habits across MySQL, MSSQL, and Oracle so testers can hunt vulnerabilities without corrupting live data.