¡¾·ì϶¹«¸æ¡¿Oracle Scripting iSurveyÄ£¿£¿£¿éÔ¶³Ì´úÂëÖ´Ðзì϶(CVE-2025-30727)

°ä²¼¹¦·ò 2025-04-16

Ò»¡¢·ì϶¸ÅÊö


·ì϶Ãû³Æ

Oracle Scripting iSurveyÄ£¿£¿£¿éÔ¶³Ì´úÂëÖ´Ðзì϶

CVE   ID

CVE-2025-30727

·ì϶ÀàÐÍ

´úÂëÖ´ÐÐ

·¢ÏÖ¹¦·ò

2025-04-16

·ì϶ÆÀ·Ö

9.8

·ì϶µÈ¼¶

ÑÏÖØ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ÀûÓÃÄѶÈ

µÍ

Óû§½»»¥

²»±ØÒª

PoC/EXP

δ¹«¿ª

ÔÚÒ°ÀûÓÃ

δ·¢ÏÖ


Oracle ScriptingÊÇOracle E-Business SuiteÖеÄÒ»¸ö×é¼þ£¬£¬ÓÃÓÚ´´½¨ºÍÖÎÀíÔÚÏßµ÷²é¡¢±íµ¥¼°¶¯Ì¬¾ç±¾¡£ËüÔÊÐíÆóҵͨ¹ý¿É¶¨ÖÆµÄ¾ç±¾ÍøÂçÓû§Êý¾Ý£¬£¬Ö§³ÖÒµÎñÁ÷³Ì×Ô¶¯»¯ºÍ¾ö²ßÖ§³Ö¡£Oracle ScriptingÌṩÁ˽ýݵÄÎʾíÉè¼Æ¹¤¾ß£¬£¬¿ÉÄÜÓëÆäËûE-Business SuiteÄ£¿£¿£¿é¼¯³É£¬£¬ÊµÏÖÊý¾ÝµÄ×Ô¶¯»¯ÍøÂçÓë´¦Ö᣸ÃÄ£¿£¿£¿é¿í·ºÀûÓÃÓÚ¿Í»§µ÷²é¡¢·´À¡ÍøÂç¡¢ºÏ¹æÐÔÆÀ¹ÀµÈ³¡¾°¡£


2025Äê4ÔÂ16ÈÕ£¬£¬OG¶«·½Ìü¼¯ÍÅVSRC¼à²âµ½Oracle°ä²¼µÄCVE-2025-30727°²È«²¼¸æ¡£²¼¸æÖ¸³ö£¬£¬Oracle E-Business Suite µÄ Oracle Scripting ²úÆ·£¨×é¼þ£º£ºiSurvey Module£©´æÔÚÒ»ÏîÑÏÖØ·ì϶£¬£¬Î´ÈÏÖ¤µÄ¹¥»÷Õß¿Éͨ¹ýHTTPÍøÂç½Ó¼ûÔ¶³ÌÀûÓø÷ì϶£¬£¬¿ÉÄܵ¼ÖÂOracle ScriptingÔâµ½½ÚÖÆ¡£³É¹¦ÀûÓô˷ì϶µÄ¹¥»÷¿ÉÄܵ¼ÖÂOracle Scripting±»ÆëÈ«¹¥Ï¡£·ì϶ÆÀ·Ö9.8·Ö£¬£¬·ì϶¼¶±ðΪÑÏÖØ¡£


¶þ¡¢Ó°ÏìÁìÓò


12.2.3 ¡Ü Oracle E-Business Suite ¡Ü 12.2.14


Èý¡¢°²È«´ëÊ©


3.1 Éý¼¶°æ±¾


¹Ù·½ÒѰ䲼°²È«²¹¶¡£¬£¬½¨ÒéÊÜÓ°ÏìÓû§¾¡¿ì¸üС£


ÏÂÔØÁ´½Ó£º£ºhttps://www.oracle.com/security-alerts/cpuapr2025.html/


3.2 һʱ´ëÊ©


ÔÝÎÞ¡£


3.3 ͨÓý¨Òé


? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬Ï÷¼õϵͳ·ì϶£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£
¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÖÆ£¬£¬Åú¸Ä·À»ðǽսÊõ£¬£¬¹Ø±Õ·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Â¶³öµ½¹«Íø£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£
ʹÓÃÆóÒµ¼¶°²È«²úÆ·£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£
¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÖÆºÍ×îСȨÏÞ×¼Ôò£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏÞ¶È¡£
ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£


3.4 ²Î¿¼Á´½Ó


https://www.oracle.com/security-alerts/cpuapr2025.html
https://nvd.nist.gov/vuln/detail/CVE-2025-30727