CVE-2022-21587 PoC — Oracle E-Business Suite 访问控制错误漏洞

Source

https://github.com/hieuminhnv/CVE-2022-21587-POC

Associated Vulnerability

Title: Oracle E-Business Suite 访问控制错误漏洞 (CVE-2022-21587)
Description:Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Description

CVE-2022-21587 POC

Readme

# CVE-2022-21587-POC-
CVE-2022-21587 POC 

```
file exploit.py will overwrite to file .pl (not recommended for use, will affect the system) 
file EBS not overwrite, will create a new shell file
```

install slipit:
      git clone https://github.com/usdAG/slipit
      
      cd slipit

      python3 setup.py sdist

      pip3 install --user dist/*

      export PATH=/home/yourname/.local/bin:$PATH
   

install uuencode:
  sudo apt-get install sharutils

Exploit: python3 http|https://example.com

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →