NGSSoftware Insight Security Research Advisory – Oracle Application Server installs a number of PLSQL packages in the backend database server. One of these is the WWV_RENDER_REPORT package and it is vulnerable to PLSQL injection. This package uses definer rights execution and therefore executes with the privileges of the owner, in this case the highly privileged PORTAL user.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/68227/NISR15072008.txt
Source: https://packetstormsecurity.com/files/68227/NISR15072008.txt.html