Oracle January 2009 Critical Patch Update Multiple Vulnerabilities
Some of these issues may not require specific exploit code and may be trivial to exploit.
Core Security Technologies has developed working commercial exploits for its CORE IMPACT product for the issues documented by CVE-2008-5449 and CVE-2008-5457. These exploits are not otherwise publicly available or known to be circulating in the wild.
The following proof-of-concept URIs are available for Oracle Secure Backup:
1. Create a file in the directory "c:\":
2. Create a PHP backdoor:
The following example URI is available for the Oracle Application Server portal:
The following example URI is available for Oracle Forms:
The following exploits and proof of concept are available: