Sumit Siddarth from www.notsosecure.com has released a small perl script to run OS commands via Oracle based Web Apps. Sumit is using the bug in dbms_export_extension. This problem was fixed with CPU July 2006 but all databases without this (or higher CPU or patchset) are affected (Oracle 184.108.40.206, 220.127.116.11 – 18.104.22.168, 10.1.0.2 – 10.1.0.4, 10.2.0.1-10.2.0.2, XE) . More details are available in my updated tutorial.
I tested the script together with him against several of my test database.
The script is easy to use. Under MacOS I had to install p5-libwww-perl to run it.
At the moment the script does not work against Oracle databases without java but I am sure sooner or later this will be changed. In my opinion the most generic way to run OS commands (as user Oracle) is PL/SQL native (Oracle 9i, Oracle 10g/11g).