CVE-2004-1338

CVE-2004-1338 describes a privilege escalation vulnerability in Oracle 9i and 10g Database Server. Local authenticated users can exploit specific triggers (CCBKAPPLROWTRIG or EXEC_CBK_FN_DML) to inject arbitrary functions into system tables. Subsequently, a DELETE operation on SDO_TXN_IDX_INSERTS executes these user-supplied functions, leading to elevated privileges. The vulnerability has a CVSS score of 6.5, indicating a medium severity. It requires authentication (Au:S) and low attack complexity (AC:L), allowing an attacker to achieve partial confidentiality, integrity, and availability impact (C:P/I:P/A:P). Despite its age, there is no known active exploitation (KEV: No), nor is public exploit code available (Metasploit, Nuclei, ExploitDB: None). Community discussion and media coverage are minimal, suggesting low public awareness or interest in this specific CVE.