Exploit for CVE-2023-22047---Oracle-PeopleSoft-LFI

kitploit · 2026-08-22

Description

Unauthenticated LFI in Oracle PeopleSoft PeopleTools allows reading arbitrary server files.

Entry point

Parameterwsrp-url · query param

Path/RP

Unauthenticated Local File Inclusion via wsrp-url parameter on /RP endpoint (CWE-22: Path Traversal)

Affected Oracle Peoplesoft Enterprise versions

Oracle Peoplesoft Enterprise= 8.59, 8.60

All known vulnerabilities by product

Peoplesoft Enterprise Peopletools

CVSS 7.5 for CVE-2023-22047

7.5

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:NONE

Availability:NONE

CVE Information

Exploit Details

Modified:2026-08-22 20:50

Last Seen:2026-08-26 03:37

Reporter:KitPloit

Tags

Oracle PeopleSoftPeopleToolsLocal File InclusionUnauthenticatedArbitrary File ReadCVE-2023-22047

Other exploits for CVE-2023-22047

2026-09-11 KitPloitKITPLOIT

CVE-2023-22047-Oracle-PeopleSoft-LFI

2026-09-05 KitPloitKITPLOIT

Exploit for Missing Authentication for Critical Function in Oracle Peoplesoft_Enterprise

2026-08-15 0xTerrorGITHUB

Exploit for Missing Authentication for Critical Function in Oracle Peoplesoft_Enterprise

2026-08-15 0xTerrorGITHUB

Exploit for Missing Authentication for Critical Function in Oracle Peoplesoft_Enterprise

2025-04-02 tuo4n8GITHUB

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-0XTERROR-CVE-2023-22047---ORACLE-PEOPLESOFT-LFI
# CVE-2023-22047---Oracle-PeopleSoft-LFI

CVE-2023-22047 — это критическая уязвимость локального включения файлов (Local File Inclusion, LFI) без аутентификации в Oracle PeopleSoft Enterprise PeopleTools. Этот эксплойт позволяет злоумышленнику читать произвольные файлы с целевого сервера без какой-либо аутентификации.