Oracle AS Portal Cross Site Scripting

`Oracle AS Portal is a Web-based application for building and deploying portals. It provides a   
secure, manageable environment for accessing and interacting with enterprise software services   
and information resources. A vulnerability has been identified in Oracle Application Server 10g,   
This could be exploited to conduct cross site scripting attacks. Attackers can run arbitrary code   
that can be executed by the user's browser in the security context of an affected site. Attackers   
can exploit these issues via a web client.  
  
  
Hackers Center Security Group (http://www.hackerscenter.com)  
Credit: Oleg P.  
  
Class: Cross Site Scripting  
Remote: Yes  
Risk: Medium  
  
Product: Oracle Application Server Portal (OracleAS Portal) 10g  
Version: Tested 10.1.3 and Earlier/ Other version may be affrected too.  
Vendor: http://www.oracle.com  
  
  
- Cross Site Scripting -  
  
Login script:  
  
/sso/jsp/login.jsp?site2pstoretoken=XSS  
  
  
Search Script:  
  
PORTAL&search_type=XSS  
  
  
  
  
Google: FastCGI Script - Displays environment settings using FastCGI.  
  
http://www.google.com/search?q=FastCGI+echo&btnG=Search&hl=en&sa=2  
  
http://www.google.com/search?hl=en&q=fcgi-bin%2Fecho&btnG=Google+Search&aq=f&oq=  
  
Buy locating the script you can locate the server url:  
  
SiteServer.com/fcgi-bin/echo  
  
  
  
  
  
Google for Oracle Servers:  
  
http://www.google.com/search?hl=en&q=Contents%3A+Working+with+Oracle+Application+Server+Single+Sign-On+-+Oracle+Application+Server+Single+Sign-On&btnG=Google+Search&aq=f&oq=  
  
  
PATCHES AND UPDATES:  
  
http://www.oracle.com/technology/deploy/security/alerts.htm  
`