Exploitation Summary
CVE-2012-3152 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.
EIP tracks 4 public exploits from researchers including Metasploit, Mekanismen, abq0, including a Metasploit module exploits/multi/http/oracle_reports_rce.
AI-analyzed exploit summary This Metasploit module exploits CVE-2012-3152 and CVE-2012-3153 in Oracle Forms and Reports to achieve remote code execution by leveraging path disclosure and arbitrary file write vulnerabilities. It uploads a JSP payload to the target system and executes it.
Description
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.
Exploits (4)
This Metasploit module exploits CVE-2012-3152 and CVE-2012-3153 in Oracle Forms and Reports to achieve remote code execution by leveraging path disclosure and arbitrary file write vulnerabilities. It uploads a JSP payload to the target system and executes it.
This Ruby script automates the exploitation of CVE-2012-3152 and CVE-2012-3153 in Oracle Reports 11.1 by uploading a malicious JSP payload to a vulnerable server. It enumerates keymaps, extracts server credentials, and leverages the 'showenv' endpoint to determine the local path for payload deployment.
This repository contains a Python-based scanner for detecting and testing vulnerabilities in Oracle Reports Server (rwservlet) related to CVE-2012-3152 and CVE-2012-3153. It includes functionality for LFI (Local File Inclusion), SSRF (Server-Side Request Forgery), and shell upload testing, but does not contain a full exploit PoC for achieving remote code execution.
This Metasploit module exploits CVE-2012-3152 and CVE-2012-3153 in Oracle Forms and Reports to achieve remote code execution by leveraging path traversal and arbitrary file write vulnerabilities. It first discloses server paths via the 'showenv' endpoint, then uploads a malicious JSP payload to a writable directory, and executes it.
References (12)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N