Published: 16/10/2012 Updated: 29/08/2017

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

VMScore: 645

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote malicious users to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote malicious users to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle fusion middleware 11.1.2.0
oracle fusion middleware 11.1.1.4.0
oracle fusion middleware 11.1.1.6.0

#!/usr/bin/env ruby # Exploit Title: Oracle Reports 111 # About: Automated exploit for CVE-2012-3153/CVE-2012-3152 # Google Dork: inurl:/reports/rwservlet/ # Date: 01/28/2014 # Exploit Author: Mekanismen <mattias@gotrooteu> # Credits to: @miss_sudo for initial disclosure # Reference: netinfiltrationcom/ # Vendor Homepage: ww ...

An undocumented PARSEQUERY function in Oracle Forms and Reports allows dumping database username and passwords unauthenticated The patch / workaround just appears to obfuscate the issue but not actually address it Affected systems include versions 9iAS, 9iDS, 10G (DS and AS), and 10G AS Reports/Forms Standalone Installation, 11g if patch or worka ...

This Metasploit module uses two vulnerabilities in Oracle forms and reports to get remote code execution on the host The showenv url can be used to disclose information about a server A second vulnerability that allows arbitrary reading and writing to the host filesystem can then be used to write a shell from a remote url to a known local path di ...

Automated exploit for CVE-2012-3153 / CVE-2012-3152

pwnacle-fusion Automated exploit for Oracle Reports, CVE-2012-3153 / CVE-2012-3152 Credits to @miss_sudo for the disclosure Usage: /pwnaclerb target_url payload_url This exploit uses both CVEs to upload a jsp shell from your payload_url which is then reachable from /reports/images/shelljsp payload_url should contain a jsp payload but it could be anything really with some m

NVD-CWE-noinfo http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://seclists.org/fulldisclosure/2014/Jan/186 http://www.exploit-db.com/exploits/31253 http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/http://www.securityfocus.com/bid/55961 http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/https://exchange.xforce.ibmcloud.com/vulnerabilities/79296 https://nvd.nist.gov https://github.com/Mekanismen/pwnacle-fusion https://www.exploit-db.com/exploits/31253/

CVE-2012-3153

Vulnerability Summary

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect