Oracle 9i – 10g Rel.2 Advisory: Updates, deletes and inserts are possible with least-privilege via inline views. A user with create session only can insert/update/delete data (e.g. the dual table). This bug is similar but not identical to the bug which was fixed in the July 2006 CPU (Modify Data via views). No workarounds available.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/51381/Oracle9i-views.txt
Source: https://packetstormsecurity.com/files/51381/Oracle9i-views.txt.html