defa138d04
17 changes to exploits/shellcodes Modbus Poll 7.2.2 - Denial of Service (PoC) AudaCity 2.3 - Denial of Service (PoC) Apple Intel GPU Driver - Use-After-Free/Double-Delete due to bad Locking Apple iOS/macOS - Sandbox Escape due to Trusted Length Field in Shared Memory used by HID Event Subsystem Apple iOS - Kernel Stack Memory Disclosure due to Failure to Check copyin Return Value Apple iOS/macOS - Sandbox Escape due to mach Message sent from Shared Memory Apple iOS/macOS - Kernel Memory Corruption due to Integer Overflow in IOHIDResourceQueue::enqueueReport Apple iOS Kernel - Use-After-Free due to bad Error Handling in Personas Windows - SetImeInfoEx Win32k NULL Pointer Dereference (Metasploit) Countly - Persistent Cross-Site Scripting Countly - Cross-Site Scripting MySQL Edit Table 1.0 - 'id' SQL Injection School ERP Ultimate 2018 - Arbitrary File Download Oracle Siebel CRM 8.1.1 - CSV Injection The Open ISES Project 3.30A - 'tick_lat' SQL Injection School ERP Ultimate 2018 - 'fid' SQL Injection eNdonesia Portal 8.7 - 'artid' SQL Injection The Open ISES Project 3.30A - Arbitrary File Download Viva Visitor & Volunteer ID Tracking 0.95.1 - 'fname' SQL Injection
42 lines
No EOL
2 KiB
Text
42 lines
No EOL
2 KiB
Text
# Exploit Title: Oracle Siebel CRM 8.1.1 - CSV Injection
|
||
# Date: 2018-10-21
|
||
# Exploit Author: Sarath Nair aka AceNeon13
|
||
# Contact: @AceNeon13
|
||
# Vendor Homepage: www.oracle.com
|
||
# Software Link: http://www.oracle.com/us/products/applications/siebel/siebel-crm-8-1-1-066196.html
|
||
# Version: Oracle Siebel CRM Version 8.1.1 and below
|
||
|
||
# PoC Exploit: CSV Injection
|
||
# Vulnerable URL: All CSV Export functionalities within the CRM application
|
||
# Description: Siebel CRM application was found to be vulnerable to Excel Macro injection vulnerability,
|
||
# in places where user input is allowed (in text form) and the input can then be exported in CSV
|
||
# form. An attacker can change user information to include in his input a malicious excel function.
|
||
|
||
=-2+3+cmd|' /C calc'!D
|
||
|
||
# The function will then be executed on the victim’s machine,
|
||
# once the victim exports the details in CSV format and opens the exported file in Microsoft Excel.
|
||
|
||
# Impact: The vulnerability doesn’t target the web application but rather its users.
|
||
# A hypothetical attacker could use it, in order to trick other application users into unwillingly
|
||
# executing arbitrary malicious code, potentially leading to full a compromise of their workstation.
|
||
# Although excel has implemented certain features to protect its users
|
||
# (the user is asked whether he wants to execute a potentially harmful external script),
|
||
# the user could easily assume that the content can be trusted since the file is
|
||
# extracted from a trusted source.
|
||
|
||
# Solution: Disable CSV export in all list applets and where CSV export is available.
|
||
# https://docs.oracle.com/cd/E95904_01/books/Secur/siebel-security-hardening.html#c_Patch_Management_ai1029938a
|
||
|
||
########################################
|
||
# Vulnerability Disclosure Timeline:
|
||
|
||
2017-November-20: Discovered vulnerability
|
||
2017-November-23: Vendor Notification
|
||
2017-November-29: Vendor Response/Feedback
|
||
2018-October-04: Vendor Fix/Patch/Workaround
|
||
2018-October-21: Public Disclosure
|
||
########################################
|
||
|
||
Warm regards,
|
||
Sarath Nair |