Something like this, plus passphrase-less pubkey auth should do the trick:

# create an ssh connection for tunneling only, in the background (this assumes tunneling is allowed... usually is)
ssh -N -L 9999:database_name:22 [email protected] &
pid=$!

# connect to the 2nd machine directly, using the tunnel, also run only the sqlplus command. (this assumes sudo is installed)
ssh -oPort 9999 localhost sudo -u appuser sqlplus ..

kill $pid

The first command can be replaced by a special config in ~/.ssh/config. See the "Host tunnel" example in this page.

Something like this, plus passphrase-less pubkey auth should do the trick:

# create an ssh connection for tunneling only, in the background (this assumes tunneling is allowed... usually is)
ssh -N -L 9999:database_name:22 [email protected] &
pid=$!

# connect to the 2nd machine directly, using the tunnel, also run only the sqlplus command. (this assumes sudo is installed)
ssh -oPort 9999 localhost sudo -u appuser sqlplus ..

kill $pid

The first command can be replaced by a special config in ~/.ssh/config. Here's an example:

Host mytunnel
    User unix_id
    Hostname something.com
    LocalForward 9999 localhost:22

Host sqlviatunnel
    User unix_id
    Hostname localhost
    Port 9999
    ProxyCommand ssh -q -W %h:%p mytunnel

And then

ssh sqlviatunnel

Rename sqlviatunnel to something shorter.