Oracle Application Server Discussion Forum Portlet Multiple Vulnerabilities

vendor:

Oracle Application Server Discussion Forum Portlet

by:

Unknown

5.5

CVSS

MEDIUM

Cross-Site Scripting (XSS), HTML Injection, Source Code Disclosure

79, 80, 200

CWE

Product Name: Oracle Application Server Discussion Forum Portlet

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: NO

Related CWE: CVE-2005-1234, CVE-2005-5678

CPE: oracle:application_server_discussion_forum_portlet

Metasploit:

Other Scripts:

Platforms Tested:

2005

Oracle Application Server Discussion Forum Portlet Multiple Vulnerabilities

The Oracle Application Server Discussion Forum Portlet is affected by multiple remote vulnerabilities. The application is prone to a cross-site scripting vulnerability and multiple HTML injection vulnerabilities. It is also vulnerable to a source code disclosure vulnerability. An attacker can exploit these vulnerabilities to execute arbitrary script code, inject malicious HTML, and disclose sensitive source code information.

Mitigation:

It is recommended to remove or disable the Oracle Application Server Discussion Forum Portlet from production environments. Apply relevant patches or updates provided by the vendor.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/16048/info

Oracle Application Server Discussion Forum Portlet is affected by multiple remote vulnerabilities.

The following specific vulnerabilities were identified:

The application is prone to a cross-site scripting vulnerability.

Discussion Forum Portlet is also affected by multiple HTML injection vulnerabilities.

The application is vulnerable to a source code disclosure vulnerability as well.

All versions of Oracle Application Server Discussion Forum Portlet are considered to be vulnerable. It should be noted that Oracle Application Server Discussion Forum Portlet is not meant to be used in a production environment. 

Cross-site scripting:
http://www.example.com/portal/page?_pageid=XXX,XXX&_dad=portal&_schema=PORTAL&
df_next_page=htdocs/forums.jsp&
RowKeyValue=<script>alert(document.cookie)</script>

Source code disclosure:
http://www.example.com/portal/page?_pageid=XXX,XXX&_dad=portal&_schema=PORTAL&
df_next_page=htdocs/search.jsp%00