CVE-2012-3153
EXPLOITED NUCLEIOracle Forms and Reports Remote Code Execution
Title source: metasploitExploitation Summary
CVE-2012-3153 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including Mekanismen, including a Metasploit module exploits/multi/http/oracle_reports_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Ruby script automates the exploitation of CVE-2012-3152 and CVE-2012-3153 in Oracle Reports 11.1 by uploading a malicious JSP payload to a vulnerable server. It enumerates keymaps, extracts server credentials, and leverages the 'showenv' endpoint to determine the local path for payload deployment.
Description
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
Exploits (4)
This Ruby script automates the exploitation of CVE-2012-3152 and CVE-2012-3153 in Oracle Reports 11.1 by uploading a malicious JSP payload to a vulnerable server. It enumerates keymaps, extracts server credentials, and leverages the 'showenv' endpoint to determine the local path for payload deployment.
This is a Ruby-based exploit for CVE-2012-3153 and CVE-2012-3152 targeting Oracle Reports. It automates the process of uploading a JSP payload to a vulnerable server via directory traversal and arbitrary file upload vulnerabilities.
This repository contains a Python-based scanner for detecting and exploiting CVE-2012-3153 in Oracle Reports Server. It includes functionality for LFI, SSRF testing, and JSP shell upload, but does not contain a full exploit PoC.
This Metasploit module exploits CVE-2012-3153 in Oracle Forms and Reports to achieve remote code execution by leveraging directory traversal and arbitrary file write vulnerabilities to upload a JSP shell.
Nuclei Templates (1)
http.title:"weblogic" || http.html:"weblogic application server"
title="weblogic" || body="weblogic application server"