Muhammad Zeeshan

An easily exploitable issue exists in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin). An unauthenticated attacker with network access via HTTP can compromise Oracle Scripting. Successful attacks require human interaction from a person other than the attacker. While the issue is in Oracle Scripting, attacks may impact additional products. Successful attacks can result in unauthorized update, insert, or delete access to some Oracle Scripting accessible data, as well as unauthorized read access to a subset of Oracle Scripting accessible data.

The software is susceptible to a Server-Side Request Forgery (SSRF) issue. This is caused by a time-of-check/time-of-use (TOCTOU) race condition within the 'url' parameter of the `fpd custom uplod file` AJAX action. The validation process uses `getimagesize()` followed by `file get contents()` on the same URL, creating a timing gap that allows attackers to redirect requests to arbitrary internal or external URLs.

The software is susceptible to a Full Path Disclosure issue. This stems from improper error handling within the PDF upload functionality, which reveals server filesystem paths and stack traces in error messages. An unauthenticated attacker can potentially retrieve the full path of the web application. The disclosed information, while not directly damaging, can assist in facilitating other attacks.

The software contains a flaw due to inadequate validation of user-provided input in the `url` parameter of the 'fpd custom uplod file' AJAX action. This input is directly passed to the `getimagesize()` function without proper sanitization. While exploitation via PHP filter chains is restricted on PHP 8 and later versions, the issue can be exploited through a TOCTOU race condition or may be directly exploitable on PHP 7.x installations. This allows unauthenticated attackers to read arbitrary sensitive files from the server, such as `wp-config.php`.

The software is susceptible to Stored Cross-Site Scripting through SVG File uploads. Insufficient input sanitization and output escaping in the `data-to-image.php` and `pdf-to-image.php` files allow unauthenticated attackers to inject arbitrary web scripts. These scripts execute when a user accesses the SVG file.

A reflected cross-site scripting issue allows attackers to execute arbitrary code in the context of a user's browser by injecting a crafted payload into the "mw/" endpoint.

The issue allows unauthenticated attackers to perform SQL Injection via the `ssf wp user name` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This enables attackers to append additional SQL queries into an already existing query, potentially leading to stored cross-site scripting in store reviews.

The issue allows authenticated attackers with contributor-level access and above to make web requests to arbitrary locations originating from the web application. This can be used to query and modify information from internal services through the `form to url action` function.

The issue allows authenticated attackers with editor-level access and above to perform SQL Injection via the `entry` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This enables attackers to append additional SQL queries into already existing queries, potentially extracting sensitive information from the database.

The issue is related to Reflected Cross-Site Scripting via the `s` parameter in multiple instances due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The issue allows unauthorized access to data due to a missing capability check on the `get uri editor` function. This enables unauthenticated attackers to view the permalinks of all posts.

The issue allows unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism. This is possible due to sensitive information exposure in the '/wp-content/uploads/fusion-forms/' directory.

The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue allows unauthorized modification of data due to a missing capability check on the `save footer text callback` function. This makes it possible for unauthenticated attackers to inject arbitrary HTML content into the site's footer.

The issue is related to a missing capability check on the `admin reload nav menu()` function, which allows unauthenticated attackers to modify the location of display menus. This makes it possible for unauthorized modification of data.

The issue arises from a missing capability check on the `ajax save permalink` function, allowing authenticated attackers with author access or above to modify the permalinks of arbitrary posts. This enables unauthorized modification of data.

The issue allows authenticated attackers with contributor access and above to view the contents of all form submissions, including fields that are obfuscated, such as the contact form's `password` field, via the form entries page.

The issue is related to arbitrary file uploads due to missing file type validation in the `ajax import options()` function. This makes it possible for authenticated attackers, with contributor-level access and above, to upload arbitrary files on the affected site's server, which may lead to remote code execution. The flaw is estimated to affect nearly 950,000 sales.

The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with administrative privileges to inject arbitrary web scripts in pages via the `api key` parameter. This enables the execution of injected scripts whenever a user accesses an injected page.

The issue is related to Cross-Site Request Forgery due to missing nonce validation on the `list quizzes()` function. This allows unauthenticated attackers to delete quizzes and copy quizzes via a forged request if they can trick a site administrator into performing a specific action.