CVE-2022-21587

This repository contains two Python scripts exploiting CVE-2022-21587, a vulnerability in Oracle E-Business Suite. The exploits achieve remote code execution by uploading malicious JSP or Perl scripts via a file upload vulnerability in the BneUploaderService endpoint.

This exploit targets CVE-2022-21587 in Oracle E-Business Suite, leveraging an unauthenticated file upload vulnerability to achieve remote code execution (RCE). The PoC uploads a malicious Perl script via a UUE-encoded ZIP file and triggers execution via a custom HTTP header.

This repository contains a functional exploit for CVE-2022-21587, targeting Oracle E-Business Suite (EBS) versions 12.2.3-12.2.11. The exploit leverages unauthenticated remote code execution via a malicious ZIP upload and CGI script execution.

This repository contains a functional Python script that decrypts the admin password for JD Edwards EnterpriseOne Tools by exploiting CVE-2020-2733. The script fetches an encrypted string from a target URL or processes a provided string, then decrypts it using AES-CBC with hardcoded keys derived from the vulnerability's technical details.

This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in Oracle E-Business Suite (EBS) versions 12.2.3 to 12.2.11. It uploads a malicious JSP file via a ZIP archive encoded with uuencode, then triggers execution to achieve remote code execution as the 'oracle' user.