CVE-2010-3600: Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control 10.2.0.5…

PriorityP273high7.5CVSS 2.0

AVNACLAuNCPIPAP

EXPLOIT

EPSS

76.69%

99.5th percentile

Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control 10.2.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that this issue involves an exposed JSP script that accepts XML uploads in conjunction with NULL bytes in an unspecified parameter that allow execution of arbitrary code.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
oracle	database_server	—	—
oracle	database_server	—	—
oracle	enterprise_manager_grid_control	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Monitor for HTTP POST requests to /em/ecm/csa/v10103/CSAr.jsp on port 1158 (SSL), especially with a 'sessionID' parameter containing null bytes (\x00) used to bypass file extension checks. ↗
→Detect directory traversal sequences ('..\') in the sessionID POST parameter targeting CSAr.jsp, used to write files outside the web root (e.g., to system32 or wbem\mof). ↗
→Alert on creation of unexpected .mof files in C:\windows\system32\wbem\mof\ or .vbs files in C:\windows\system32\, which indicate WMI-based payload execution following exploitation. ↗
→Look for HTTP 200 responses from CSAr.jsp containing the string 'posted data was written to placeholder file' or 'csaPostStatus=0', which confirm successful file upload. ↗
→The exploit targets Oracle EM Grid Control running on Windows; check for Oracle Containers for J2EE in the server banner as a prerequisite fingerprint. ↗

·The Metasploit module default traversal depth is 13 levels ('..\' * 13); defenders should tune path-traversal detection rules to cover at least this depth. ↗
·SSL is enabled by default on port 1158; network inspection must perform SSL/TLS interception to detect the malicious POST payload in transit. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.