CVE-2004-2115

published 2004-12-31

CVE-2004-2115: Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other…

Priority P3 39 medium 6.8 CVSS 2.0

AV N AC M Au N C P I P A P

EXPLOIT

Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
oracle	http_server	—	—
oracle	http_server	—	—
oracle	http_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http:///isqlplus?action=logon&username=sdfds%22%3e%3cscript%3ealert('XSS')%3c/script%3e\&password=dsfsd%3cscript%3ealert('XSS')%3c/script%3e↗

url http:///isqlplus?action=alert('XSS')↗

path /isqlplus↗

• → Monitor HTTP requests to the /isqlplus endpoint for URL-encoded script injection patterns (e.g., %3cscript%3e, %3e%3c) in the action, username, or password query parameters. ↗
• → Alert on requests to /isqlplus where the action parameter contains non-standard values (e.g., JavaScript payloads) rather than expected values like 'logon'. ↗
• → Inspect for theft of cookie-based authentication credentials as a post-exploitation indicator following successful XSS exploitation against Oracle HTTP Server isqlplus. ↗

• · The vulnerability affects Oracle HTTP Server versions 8.1.7, 9.0.1, and 9.2 (based on Apache 1.3.22); detections should be scoped to environments running these specific versions. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.