PL or SQL : Dangerous function

DBMS_UTILITY.EXEC_DDL_STATEMENT only executes statements defined as part of the Data Definition Language. Other statements are silently ignored, which makes debugging difficult.

The DBMS_XMLGEN package converts the results of a SQL query to a canonical XML format in real-time. An attacker can exploit this package to inject SQL code. Thus, all data, including user credentials can be extracted from the database. Given that this package is extremely dangerous, the need for its use should be carefully scrutinized. If dynamic database queries in XML format are not required, the package should be removed.