PL or SQL : Default SID value

The application uses a string whose value corresponds to one of default values of the site identifier (SID). Adversaries can use default SID values to carry out an attack.

The database instance is identified by SID (System IDentifier). The SID contains alphanumeric characters and is stored in the ORACLE_SID system environment variable. SID uses network utilities to obtain remote access to the database.

Without knowing the SID of the Oracle database, the attacker will not be able to access the database, even if he knows username and password. Knowing the SID of the database, an attacker can, for example, configure database accounts.

Some of the default SID values: ORCL, XE, ASDB, IASDB, OEMREP.