Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052221 漏洞类型
发布时间 2009-01-30 更新时间 2009-01-30
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2009010083
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
 Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)

About: Oracle Forms is a tool (somewhat like Visual Basic in appearance, but the code inside is PL/SQL) 
which allows a developer to quickly create user-interface applications which access an Oracle database 
in a very efficient and tightly-coupled way. It was originally developed to run server-side in character 
mode on any Unix box, before Windows existed. It was then ported to Windows to function in a client-server 
environment. This could be exploited to conduct cross site scripting attacks. Attackers can run arbitrary 
code that can be executed by the user's browser in the security context of an affected site. Attackers can 
exploit these issues via a web client.


Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Oleg P.

Class: Cross Site Scripting
Remote: Yes
Risk: Medium

Product: Oracle Forms 6i Servlets
Version: Tested 6i Servlets/ Other version may be affrected too. 
(E-Business Suite 11i)

Vendor: http://www.oracle.com


iFcgi60.exe / f60servlet Cross site scripting


ifcgi60.exe?form=XSS

iFcgi60.exe Google:
http://www.google.com/search?hl=en&q=ext%3Aexe+inurl%3A(ifcgi60)&btnG=Search


f60servlet?&form=XSS

f60servlet Google:
http://www.google.com/search?hl=en&q=inurl%3A(f60servlet)&btnG=Search


Open Admin Access:

f60servlet/admin



PATCHES AND UPDATES:

http://www.oracle.com/technology/deploy/security/alerts.htm