oracle1016-xss.txt

`Name Cross-Site-Scripting Vulnerability in Oracle Secure Enterprise Search  
Systems Affected Oracle Secure Enterprise Search 10.1.6- SES  
Severity Medium Risk  
Category Cross Site Scripting (XSS/CSS)  
Vendor URL http://www.oracle.com/  
Author Alexander Kornbrust (ak at red-database-security.com)  
Date 17 April 2007 (V 1.00)  
  
  
Details  
#######  
Oracle Secure Enterprise Search 10g, a standalone product from Oracle, enables a secure, high quality, easy-to-use search across all enterprise information assets.  
  
The parameter EXPTYPE in boundary_rules.jsp contains a cross site scripting vulnerability.  
  
This advisory is available at  
<http://www.red-database-security.com/advisory/oracle_css_ses.html>  
  
  
Exploit  
#######  
<http://ses10106:7777/search/admin/sources/boundary_rules.jsp?event=deleteIncludeRule&p_src=web&p_mode=edit&p_id=3&pattern=rds&expType=%3Cscript%3Ealert(document.cookie)%3C/script%3ECC_SIMPLE_INCLUSION'>  
  
  
Affected Products  
#################  
Oracle Enterprise Search  
  
  
Patch Information  
#################  
Please upgrade to the latest version of SES or apply CPU April 2007.  
  
  
  
History  
#######  
05-Apr-2005 Oracle secalert was informed  
06-Apr-2005 Bug confirmed  
17-apr-2007 Oracle published CPU April 2007  
17-apr-2007 Red-Database-Security published this advisory  
  
  
Additional Information  
######################  
An analysis of the Oracle CPU April 2007 is available here   
<http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html>  
  
This document will be updated during the next few days and weeks with the latest information.  
  
  
(c) 2007 by Red-Database-Security GmbH  
--  
http://www.red-database-security.com  
`