Exploitation Summary
EIP tracks 2 public exploits for CVE-2013-5795.
PoCs published by Portcullis, Oliver Gruskovnjak, including Metasploit module auxiliary/scanner/http/oracle_demantra_database_credentials_leak.
AI-analyzed exploit summary The exploit describes a method to retrieve Oracle Demantra database credentials by calculating a static UAK key and sending a crafted request to the ServerDetailsServlet endpoint. The writeup includes a Java-based key generator and demonstrates how the encrypted credentials can be decrypted.
Description
Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, 12.2.2, and 12.2.3 allows remote attackers to affect confidentiality via unknown vectors related to DM Others.
Exploits (2)
The exploit describes a method to retrieve Oracle Demantra database credentials by calculating a static UAK key and sending a crafted request to the ServerDetailsServlet endpoint. The writeup includes a Java-based key generator and demonstrates how the encrypted credentials can be decrypted.
This Metasploit module exploits an authentication bypass and database credentials leak in Oracle Demantra 12.2.1. It sends a crafted GET request to retrieve encoded credentials, which are then decoded using a simple XOR operation.