Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Anonymous SQL Execution in Oracle Advanced Support

netspi.com | blog | #web-security | #penetration-testing | #oracle | #unauthenticated | #sql-execution

Summary

An exposed JavaScript file on an Oracle Advanced Support server revealed unauthenticated REST endpoints under /rest/data/ that executed arbitrary SQL, uncovered through external pentest recon.
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
Advisory: Oracle Forms 10g Unauthenticated Remote Code Execution (CVE-2014-4278)
Oracle Forms 10g fails to validate the ifip parameter passed to ListenerServlet, letting unauthenticated attackers execute arbitrary commands; E-Business Suite 12.0.6-12.2.4 is also affected.
blog · netspi.com
Vibe Coding: A Pentester’s Dream
NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.
blog · netspi.com
Prototype Pollution: A Deep-Dive
A deep dive into JavaScript prototype pollution: how attackers control undeclared variables to turn weakly-typed checks into XSS on the client side or remote code execution on the server side.
blog · netspi.com
Why TOTP Won’t Cut It (And What to Consider Instead)
NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.
blog · netspi.com
Exploiting XPath Injection Weaknesses
A technical walkthrough of XPath injection: how unvalidated input in XML queries enables authentication bypass and data theft, with a vulnerable lab and Burp Suite techniques for identifying the flaw.
blog · netspi.com
Macros Demystified
A three-part video series demystifies Burp Suite macros: capturing dynamic values like CSRF tokens, chaining sessions, and automating complex multi-request scenarios, with practice labs included.
back