Yesterday Bernardo Damele released the new version 0.6.4.1 of the automatic SQL injection tool. sqlmap supports all databases (including Oracle) and can automatically exploit sql injection vulnerabilities and enumerate database information like usernames, privileges, … or download table content .
The latest changes are available in the changelog.
Here are 2 screenshots from a vulnerable test application (with Oracle 11g).
I also tried to run sqlmap 0.6.4.1 against my test server but this version was not able to find the sql injection.
Update:
Today Bernardo has send me an email that he will release an updated version of sqlmap within the next few weeks.