Sploitus

Exploit for Missing Authentication for Critical Function in Oracle Peoplesoft Enterprise

CVE-2023-22047

githubexploit · 2026-08-15

Exploit Code

README68 lines
## https://sploitus.com/exploit?id=BA479E58-398A-5504-BB17-B93CC1201D68
# 🚀 CVE-2023-22047 - PeopleSoft LFI Exploit
  
  **Unauthenticated Local File Inclusion (LFI) in Oracle PeopleSoft Enterprise PeopleTools**
  
  [![GitHub stars](https://img.shields.io/github/stars/0xterror/CVE-2023-22047-PoC.svg?style=social)](https://github.com/0xterror/CVE-2023-22047-PoC/stargazers)
  [![GitHub forks](https://img.shields.io/github/forks/0xterror/CVE-2023-22047-PoC.svg?style=social)](https://github.com/0xterror/CVE-2023-22047-PoC/network/members)
  [![GitHub license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
  [![Python](https://img.shields.io/badge/Python-3.x-blue?style=flat&logo=python)](https://www.python.org/)
  


---

## 👨‍💻 Author


  
  
  ### 0xTerror
  **Security Researcher | Exploit Developer**
  
  [![GitHub](https://img.shields.io/badge/GitHub-0xTerror-181717?style=for-the-badge&logo=github)](https://github.com/0xterror)
  [![Twitter](https://img.shields.io/badge/Twitter-@0xterror-1DA1F2?style=for-the-badge&logo=twitter)](https://twitter.com/0xterror)
  


---

## 📋 Description

CVE-2023-22047 is a critical **unauthenticated Local File Inclusion (LFI)** vulnerability discovered in **Oracle PeopleSoft Enterprise PeopleTools**. This exploit allows an attacker to read arbitrary files from the target server without any authentication, leading to potential exposure of sensitive data such as:

- 🔐 System configuration files
- 🔑 Database credentials
- 🛡️ WebLogic admin credentials
- 📄 Source code
- 🌐 Environment variables
- 🔓 Password hashes

---

## 🔍 What Makes It Vulnerable

### Root Cause Analysis

The vulnerability exists in the **Updates Environment Management** component of PeopleSoft Enterprise PeopleTools. The flaw is triggered by improper handling of the `wsrp-url` parameter in the `/RP` endpoint.

### Technical Breakdown

| Aspect | Details |
|--------|---------|
| **Component** | Updates Environment Management |
| **Endpoint** | `/RP` (Resource Provider) |
| **Parameter** | `wsrp-url` |
| **Attack Vector** | HTTP GET request |
| **Authentication** | ❌ None required |
| **Vulnerability Type** | CWE-22: Path Traversal |
| **CVSS Score** | **9.8 (Critical)** |

### Attack Flow Diagram

```mermaid
graph LR
    A[Attacker] -->|GET /RP?wsrp-url=file:///etc/passwd| B[PeopleSoft Server]
    B -->|Reads /etc/passwd| C[File System]
    C -->|Returns file content| B
    B -->|Sends file content| A