Oracle Forms Cross Site Scripting

`Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)  
  
About: Oracle Forms is a tool (somewhat like Visual Basic in appearance, but the code inside is PL/SQL)   
which allows a developer to quickly create user-interface applications which access an Oracle database   
in a very efficient and tightly-coupled way. It was originally developed to run server-side in character   
mode on any Unix box, before Windows existed. It was then ported to Windows to function in a client-server   
environment. This could be exploited to conduct cross site scripting attacks. Attackers can run arbitrary   
code that can be executed by the user's browser in the security context of an affected site. Attackers can   
exploit these issues via a web client.  
  
  
Hackers Center Security Group (http://www.hackerscenter.com)  
Credit: Oleg P.  
  
Class: Cross Site Scripting  
Remote: Yes  
Risk: Medium  
  
Product: Oracle Forms 6i Servlets  
Version: Tested 6i Servlets/ Other version may be affrected too.   
(E-Business Suite 11i)  
  
Vendor: http://www.oracle.com  
  
  
iFcgi60.exe / f60servlet Cross site scripting  
  
  
ifcgi60.exe?form=XSS  
  
iFcgi60.exe Google:  
http://www.google.com/search?hl=en&q=ext%3Aexe+inurl%3A(ifcgi60)&btnG=Search  
  
  
f60servlet?&form=XSS  
  
f60servlet Google:  
http://www.google.com/search?hl=en&q=inurl%3A(f60servlet)&btnG=Search  
  
  
Open Admin Access:  
  
f60servlet/admin  
  
  
  
PATCHES AND UPDATES:  
  
http://www.oracle.com/technology/deploy/security/alerts.htm  
  
  
  
`