I have a Windows Server 2008 R2 with an Oracle database running on it.
Someone who knows my Oracle username and password claims that he can create a Windows system account somehow. And then he can control the whole server and do whatever he wants.
Is it possible to do so? Sound incredible to me.