what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

OSVDB: OSVDB-86395

Oracle Forms / Reports Remote Code Execution

Posted Feb 18, 2014

Authored by Mekanismen, Dana Taylor | Site metasploit.com

This Metasploit module uses two vulnerabilities in Oracle forms and reports to get remote code execution on the host. The showenv url can be used to disclose information about a server. A second vulnerability that allows arbitrary reading and writing to the host filesystem can then be used to write a shell from a remote url to a known local path disclosed from the previous vulnerability. The local path being accessible from an URL then allows us to perform the remote code execution using for example a .jsp shell. Tested on Windows and Oracle Forms and Reports 10.1.

tags | exploit, remote, arbitrary, shell, local, vulnerability, code execution

systems | windows

advisories | CVE-2012-3152, CVE-2012-3153, OSVDB-86395, OSVDB-86394

SHA-256 | 0ae51161a01d969079b5ae31c9e558381714eaaed892cb6da032845477f29e85

Download | Favorite | View