Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-3549

CWE-89 — SQL Injection4 documents4 sources

Severity

9.1CRITICAL

EPSS

31.0%

top 3.26%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Oracle Corporation Scripting Oracle Scripting

Timeline

PublishedApr 24

Latest updateMay 13

Description

Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting acce…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶NVDoracle/scripting7 versions+6

▶CVEListV5oracle_corporation/scripting7 versions+6

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

GHSA

GHSA-8jj8-f575-hppp: Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration)↗2022-05-13

▶

CVEList

CVE-2017-3549: Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration)↗2017-04-24

▶

💥Exploits & PoCs

Exploit-DB

Oracle E-Business Suite 12.2.3 - 'IESFOOTPRINT' SQL Injection↗2017-04-25

▶