minor bug fix to properly identify if user is admin on Oracle across all techniques

bdamele · bdamele · commit a92ae9384778 · 2013-01-18T09:22:53.000Z
diff --git a/plugins/dbms/oracle/enumeration.py b/plugins/dbms/oracle/enumeration.py
@@ -79,9 +79,6 @@ def getRoles(self, query2=False):
                             # In Oracle we get the list of roles as string
                             roles.add(role)
 
-                    if isAdminFromPrivileges(roles):
-                        areAdmins.add(user)
-
                     if user in kb.data.cachedUsersRoles:
                         kb.data.cachedUsersRoles[user] = list(roles.union(kb.data.cachedUsersRoles[user]))
                     else:
@@ -162,4 +159,8 @@ def getRoles(self, query2=False):
             errMsg += "for the database users"
             raise SqlmapNoneDataException(errMsg)
 
+        for user, privileges in kb.data.cachedUsersRoles.items():
+            if isAdminFromPrivileges(privileges):
+                areAdmins.add(user)
+
         return kb.data.cachedUsersRoles, areAdmins
