Oracle database installation directory using SQL
I am sure there is a even smarter way, but if you use the default trace file directories, which is usually the case, you will in most cases find both ORACLE_BASE and ORACLE_HOME via

SELECT VALUE FROM V$DIAG_INFO WHERE NAME = 'Diag Trace';


This gives you the absolute path to the trace files and they are inside ORACLE_BASE and ORACLE_HOME respectively.

HTH KR Peter

Edit: Have a look here for a more straight forward approach: https://dba.stackexchange.com/questions/97390/query-to-get-oracle-home-path-in-oracle-11g