Inside an Oracle Database SQL Injection Attack | Huntress

On July 27, 2026 Huntress investigated an SQL injection attack against a public-facing Java/Tomcat application backed by Oracle. The attackers used CREATE JAVA SOURCE via the JDBC connection to install a database-resident post-exploitation toolkit called 'khunt', achieved SYSTEM-level RCE, dumped registry hives (SAM/SECURITY/SYSTEM) for credential extraction, and collected task/service listings; the report includes IOCs (file paths, object names, attacker IP) and mitigation guidance to prevent SQLi and overprivileged DB accounts.