A definer’s-rights procedure is database code that executes with the privileges of its owner, not the user who called it. In Oracle, this means the procedure can access tables, packages, or system capabilities that the caller may not be allowed to use directly. This model is useful for controlled business logic, but it creates a security boundary that must be managed carefully.
In attacks, definer’s-rights routines matter because an SQL injection may be able to invoke trusted code and inherit its permissions. If such a procedure uses dynamic SQL, reaches sensitive data, or calls external routines, a low-privilege input can become high-impact execution. Defenders reduce this risk by granting EXECUTE only where needed, using invoker’s-rights code for untrusted callers, avoiding unsafe dynamic SQL, and auditing privileged stored procedures. In practice, a procedure’s rights model can decide whether injection stays a query bug or becomes privilege escalation.