PL or SQL : File system access

The application uses a package for file system management. If the arguments of the function originate from an untrusted source, an adversary can modify tablespace datafiles and control files.

By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.