COMMIT and EXIT are not needed. You need the commit statement to "confirm" data manipulation statements like INSERT, UPDATE, DELETE,...
SQL*Plus should be called in silent mode so you do not get its banner in your output.
The end of your here document should be the only characters in that line, put the closing brace in the next line.
You specify a shell in the shebang but call the script using sh. To my knowledge the shebang is ignored when you call a script like this.
testvar=$(
sqlplus -s $user/$pass << EOF
set pagesize 0 feedback off verify off heading off echo off;
whenever sqlerror exit 1
SELECT 1+1 FROM DUAl;
EOF
)
echo "testvar="$testvar