Related information

Oracle applications multiple security vulnerabilities

Hacktics Advisory Dec09: Oracle eBusiness Suite - Multiple Vulnerabilities Allow Remote Takeover

Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.OLAPIMPL_T. ODCITABLESTART

Team SHATTER Security Advisory: SQL Injection in Oracle Enterprise Manager (TARGET Parameter)

Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)

From:	Hackers Center Security Group <DoZ_(at)_hackerscenter.com>
Date:	30.01.2009
Subject:	Oracle Application Server Portal 10g Cross Site Scripting Vulnerability

OracleAS Portal is a Web-based application for building and deploying
portals. It provides a
secure, manageable environment for accessing and interacting with enterprise
software services
and information resources. A vulnerability has been identified in Oracle
Application Server 10g,
This could be exploited to conduct cross site scripting attacks. Attackers
can run arbitrary code
that can be executed by the user's browser in the security context of an
affected site. Attackers
can exploit these issues via a web client.


Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Oleg P.

Class: Cross Site Scripting
Remote: Yes
Risk: Medium

Product: Oracle Application Server Portal (OracleAS Portal) 10g
Version: Tested 10.1.3 and Earlier/ Other version may be affrected too.
Vendor: http://www.oracle.com


- Cross Site Scripting -

Login script:

/sso/jsp/login.jsp?site2pstoretoken=XSS


Search Script:

PORTAL&search_type=XSS




Google: FastCGI Script - Displays environment settings using FastCGI.

http://www.google.com/search?q=FastCGI+echo&btnG=Search&hl=en&sa=2

http://www.google.com/search?hl=en&q=fcgi-bin%2Fecho&btnG=Google+Sear
ch&aq=f&oq=

Buy locating the script you can locate the server url:

SiteServer.com/fcgi-bin/echo





Google for Oracle Servers:

http://www.google.
com/search?hl=en&q=Contents%3A+Working+with+Oracle+Application+Server+Sin
gle+Sign-On+-+Oracle+Application+Server+Single+Sign-
On&btnG=Google+Search&aq=f&oq=


PATCHES AND UPDATES:

http://www.oracle.com/technology/deploy/security/alerts.htm