2022-05-16 07:25:50 +00:00
|
|
|
id: oracle-ebusiness-registration-enabled
|
2022-05-15 20:13:32 +00:00
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Oracle E-Business Login Panel Registration Accessible
|
2022-05-16 13:20:40 +00:00
|
|
|
author: 3th1c_yuk1,tess
|
2022-05-16 07:15:30 +00:00
|
|
|
severity: info
|
2022-05-15 20:13:32 +00:00
|
|
|
description: Oracle E-Business Login Panel Registration Accessible.
|
|
|
|
|
reference:
|
|
|
|
|
- https://orwaatyat.medium.com/my-new-discovery-in-oracle-e-business-login-panel-that-allowed-to-access-for-all-employees-ed0ec4cad7ac
|
2022-05-16 07:15:30 +00:00
|
|
|
- https://twitter.com/GodfatherOrwa/status/1514720677173026816
|
|
|
|
|
metadata:
|
|
|
|
|
verified: true
|
|
|
|
|
shodan-query: http.title:"Login" "X-ORACLE-DMS-ECID" 200
|
|
|
|
|
tags: oracle,misconfig
|
2022-05-15 20:13:32 +00:00
|
|
|
|
|
|
|
|
requests:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- '{{BaseURL}}/OA_HTML/ibeCAcpSSOReg.jsp'
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: word
|
|
|
|
|
words:
|
|
|
|
|
- 'Registration'
|
|
|
|
|
- 'Register as individual'
|
2022-05-15 20:33:02 +00:00
|
|
|
- '<!-- ibeCZzpRuntimeIncl.jsp end -->'
|
2022-05-16 07:15:30 +00:00
|
|
|
condition: and
|
|
|
|
|
|
|
|
|
|
- type: status
|
|
|
|
|
status:
|
|
|
|
|
- 200
|
