CVE-2012-3152

Related Files

Oracle Forms / Reports Remote Code Execution

Posted Feb 18, 2014

Authored by Mekanismen, Dana Taylor | Site metasploit.com

This Metasploit module uses two vulnerabilities in Oracle forms and reports to get remote code execution on the host. The showenv url can be used to disclose information about a server. A second vulnerability that allows arbitrary reading and writing to the host filesystem can then be used to write a shell from a remote url to a known local path disclosed from the previous vulnerability. The local path being accessible from an URL then allows us to perform the remote code execution using for example a .jsp shell. Tested on Windows and Oracle Forms and Reports 10.1.

tags | exploit, remote, arbitrary, shell, local, vulnerability, code execution

systems | windows

advisories | CVE-2012-3152, CVE-2012-3153, OSVDB-86395, OSVDB-86394

SHA-256 | 0ae51161a01d969079b5ae31c9e558381714eaaed892cb6da032845477f29e85

Download | Favorite | View

Oracle Reports Shell Uploader

Posted Jan 28, 2014

Authored by Dana Taylor

Oracle Reports pwnacle exploit that uploads a jsp shell to the target system using the URLPARAMETER vulnerability that allows for planting files.

tags | exploit, shell

advisories | CVE-2012-3153, CVE-2012-3152

SHA-256 | 3581d647b9a2e8009d1d33ce3190ed76df5b93ae7c3bb78683ead1f423d79945

Download | Favorite | View