Oracle Application Server 9i Webcache PartialPageErrorPage Cross-Site Scripting Vulnerability
BID:13422
Info
Oracle Application Server 9i Webcache PartialPageErrorPage Cross-Site Scripting Vulnerability
| Bugtraq ID: | 13422 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-1381 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 28 2005 12:00AM |
| Updated: | Jul 12 2009 02:06PM |
| Credit: | Discovery of this issue is credited to Alexander Kornbrust. |
| Vulnerable: |
Oracle Oracle9i Application Server Web Cache 9.0.3 .1 Oracle Oracle9i Application Server Web Cache 9.0.2 .3 Oracle Oracle9i Application Server Web Cache 9.0.2 .2 Oracle Oracle9i Application Server Web Cache 2.0 .0.4 Oracle Oracle9i Application Server Web Cache 2.0 .0.3 Oracle Oracle9i Application Server Web Cache 2.0 .0.2 NT Oracle Oracle9i Application Server Web Cache 2.0 .0.2 Oracle Oracle9i Application Server Web Cache 2.0 .0.1 Oracle Oracle9i Application Server Web Cache 2.0 .0.0 |
| Not Vulnerable: | |
Discussion
Oracle Application Server 9i Webcache PartialPageErrorPage Cross-Site Scripting Vulnerability
A remote cross-site scripting vulnerability affects the Oracle Application Server 9i Webcache administration console. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.
The issue affects the 'PartialPageErrorPage' parameter of the 'webcacheadmin' script.
A remote cross-site scripting vulnerability affects the Oracle Application Server 9i Webcache administration console. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.
The issue affects the 'PartialPageErrorPage' parameter of the 'webcacheadmin' script.
Exploit / POC
Oracle Application Server 9i Webcache PartialPageErrorPage Cross-Site Scripting Vulnerability
No exploit is required to leverage this issue. The following example is available:
http://example.com:4000/webcacheadmin?SCREEN_ID=CGA.Site.ApologyPages_Edit&ACTION=Submit&PartialPageErrorPage=/inservice.html<script>alert(document.cookie)</script>&site_id=2
No exploit is required to leverage this issue. The following example is available:
http://example.com:4000/webcacheadmin?SCREEN_ID=CGA.Site.ApologyPages_Edit&ACTION=Submit&PartialPageErrorPage=/inservice.html<script>alert(document.cookie)</script>&site_id=2
Solution / Fix
Oracle Application Server 9i Webcache PartialPageErrorPage Cross-Site Scripting Vulnerability
Solution:
Reports indicate that this issue was silently addressed by the vendor. This is not confirmed. Customers are advised to contact the vendor for further information regarding obtaining and applying an appropriate fix.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Reports indicate that this issue was silently addressed by the vendor. This is not confirmed. Customers are advised to contact the vendor for further information regarding obtaining and applying an appropriate fix.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Oracle Application Server 9i Webcache PartialPageErrorPage Cross-Site Scripting Vulnerability
References:
References:
- Cross Site Scripting in Oracle Webcache 9i (Alexander Kornbrust)
- Oracle Homepage (Oracle)