bugtraq - Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200901291412.n0TEC7h3029380@www5.securityfocus.com>
Date: Thu, 29 Jan 2009 07:12:07 -0700
From: DoZ@...kersCenter.com
To: bugtraq@...urityfocus.com
Subject: Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)

Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)

About: Oracle Forms is a tool (somewhat like Visual Basic in appearance, but the code inside is PL/SQL) 
which allows a developer to quickly create user-interface applications which access an Oracle database 
in a very efficient and tightly-coupled way. It was originally developed to run server-side in character 
mode on any Unix box, before Windows existed. It was then ported to Windows to function in a client-server 
environment. This could be exploited to conduct cross site scripting attacks. Attackers can run arbitrary 
code that can be executed by the user's browser in the security context of an affected site. Attackers can 
exploit these issues via a web client.

Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Oleg P.

Class: Cross Site Scripting
Remote: Yes
Risk: Medium

Product: Oracle Forms 6i Servlets
Version: Tested 6i Servlets/ Other version may be affrected too. 
(E-Business Suite 11i)

Vendor: http://www.oracle.com

iFcgi60.exe / f60servlet Cross site scripting

ifcgi60.exe?form=XSS

iFcgi60.exe Google:
http://www.google.com/search?hl=en&q=ext%3Aexe+inurl%3A(ifcgi60)&btnG=Search

f60servlet?&form=XSS

f60servlet Google:
http://www.google.com/search?hl=en&q=inurl%3A(f60servlet)&btnG=Search

Open Admin Access:

f60servlet/admin

PATCHES AND UPDATES:

http://www.oracle.com/technology/deploy/security/alerts.htm