CVE-2014-6577 PoC — Oracle Database Server XML Developer's Kit for C组件安全漏洞

Source

https://github.com/SecurityArtWork/oracle-xxe-sqli

Associated Vulnerability

Title:Oracle Database Server XML Developer's Kit for C组件安全漏洞 (CVE-2014-6577)
Description:Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the original researcher's claim that this is an XML external entity (XXE) vulnerability in the XML parser, which allows attackers to conduct internal port scanning, perform SSRF attacks, or cause a denial of service via a crafted (1) http: or (2) ftp: URI.

Description

 Automated Oracle CVE-2014-6577 exploitation via SQLi

Readme

# oracle-xxe-sqli
Automated Oracle CVE-2014-6577 exploitation via SQLi

## Usage:
```
oracle-xxe-sqli.py [-h] [-i IP] [-p PORT] [--disable-server] [--custom-headers CUSTOM_HEADERS] 
                   [-f PAYLOAD_FILE] url

Options

positional arguments:

  url                   	URL to inject. Use * as the injection marker, just once.

optional arguments:

  -h, --help                              Show this help message and exit
  -i IP, --ip IP        		  Public ip. Useful for port forwarding. Default is this machine’s ip. (default: x.x.x.x)
  -p PORT, --port PORT  		  Port to use. Default will be chosen at random between 10000 and 20000. (default: *generated*)
  --disable-server      		  Don't start server (default: False)
  --custom-headers CUSTOM_HEADERS	  Pass a json dictionary with the custom headers. (default: None)
  -f PAYLOAD_FILE, --payload-file	  PAYLOAD_FILE
                        		  File to extract the SQL queries from (default: payloads.lst)
```

File Snapshot


 [4.0K]  /data/pocs/d9517800e286ddc20d2c90f8a338a62e58c917a0
├── [5.3K]  oracle-xxe-sqli.py
├── [ 330]  payloads.lst
└── [ 980]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!