0xterror/cve-2023-22047-oracle-peoplesoft-lfiCVE-2023-22047 is a critical unauthenticated Local File Inclusion (LFI) vulnerability in Oracle PeopleSoft Enterprise PeopleTools. This exploit allows an attacker to read arbitrary files from the target server without any authentication.
Security Researcher | Exploit Developer
CVE-2023-22047 is a critical unauthenticated Local File Inclusion (LFI) vulnerability discovered in Oracle PeopleSoft Enterprise PeopleTools. This exploit allows an attacker to read arbitrary files from the target server without any authentication, leading to potential exposure of sensitive data such as:
The vulnerability exists in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools. The flaw is triggered by improper handling of the wsrp-url parameter in the /RP endpoint.
| Aspect | Details |
|---|---|
| Component | Updates Environment Management |
| Endpoint | /RP (Resource Provider) |
| Parameter | wsrp-url |
| Attack Vector | HTTP GET request |
| Authentication | ❌ None required |
| Vulnerability Type | CWE-22: Path Traversal |
| CVSS Score | 9.8 (Critical) |
graph LR
A[Attacker] -->|GET /RP?wsrp-url=file:///etc/passwd| B[PeopleSoft Server]
B -->|Reads /etc/passwd| C[File System]
C -->|Returns file content| B
B -->|Sends file content| A