0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Oracle Siebel eBusiness Application – Multiple XSS Vulnerabilities
[==================================================================
Oracle Siebel eBusiness Application – Multiple XSS Vulnerabilities
==================================================================
Description
Security-Assessment.com has discovered that two components of the Siebel eBusiness Application Suite are vulnerable to reflected Cross Site Scripting attacks. The vulnerabilities can be exploited by both authenticated and unauthenticated remote users.
The following components have been found vulnerable:
- Siebel Web Engine;
- Siebel eBusiness Search Center.
Exploitation
The table below details where Cross Site Scripting was detected and which parameters are vulnerable:
Siebel Web Engine - Public page:
/eservice/"><script>alert(‘xss’)</script>.swe?SWECmd=Login
&SWECM=S
Some Siebel eBusiness Applications require the attacker to change
the injection using variations such as ">,‘>, %22%3E, ‘}, ‘) .
Siebel eBusiness Search Center - Only authenticated user can access this
page:
/start.swe?Id=%22%3E%3Cscript%3Ealert%28213%29%3C%2F
script%3E&SWEField=s_2_1_0_0&SWEFo=SWEForm2_0&SWENee
dContext=true&SWESP=false&SWERowIds=&SWEMethod=Find&
SWECmd=InvokeMethod&SWEVI=Search&SWEPOC=&SWETF=Searc
h&SWETargetView=&SWEDIC=false&SWEReqRowId=0&SWEView=
Find+View&SWETVI=&SWERowId=VRId-0&SWEC=4&SWEM=&SWEBI
D=1202770071&SWESPa=&SWEContainer=&SWETS=12027737651
09&SWETA=&SWEApplet=Find+Applet
Solution
Oracle has created a fix for this vulnerability which has been included as part of Critical Patch Update Advisory -October 2010. Security-Assessment.com recommends all users of Oracle eBusiness Suite to upgrade to the latest version as soon as possible. For more information on the new release of Oracle eBusines Suite patch please refer to the release notes:
http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1210593.1
# 0day.today [2024-09-28] #