Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)

About: Oracle Forms is a tool (somewhat like Visual Basic in appearance, but the code inside is PL/SQL)
which allows a developer to quickly create user-interface applications which access an Oracle database
in a very efficient and tightly-coupled way. It was originally developed to run server-side in character
mode on any Unix box, before Windows existed. It was then ported to Windows to function in a client-server
environment. This could be exploited to conduct cross site scripting attacks. Attackers can run arbitrary
code that can be executed by the user's browser in the security context of an affected site. Attackers can
exploit these issues via a web client.


Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Oleg P.

Class: Cross Site Scripting
Remote: Yes
Risk: Medium

Product: Oracle Forms 6i Servlets
Version: Tested 6i Servlets/ Other version may be affrected too.
(E-Business Suite 11i)

Vendor: http://www.oracle.com


iFcgi60.exe / f60servlet Cross site scripting


ifcgi60.exe?form=XSS


f60servlet?&form=XSS



Open Admin Access:

f60servlet/admin



PATCHES AND UPDATES:

Vendor has been contacted and produced a valid patch addressing the issue:

http://www.oracle.com/technology/deploy/security/alerts.htm


 

A vulnerability has been identified in SchoolCenter Software, which could be exploited to conduct cross site scripting attacks. Attackers can run arbitrary code that can be executed by the user's browser in the security context of an affected site. Attackers can exploit these issues via a web client.

Xerox DocuShare is a flexible Web-based content management solution that brings greater productivity to every knowledge worker. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.