Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble
Attackers probe another EBS bug, and ShinyHunters' PeopleSoft 0-day turns out to involve three vulns
As Oracle closes out Cybersecurity Awareness Month, the tech giant faces mounting concerns over critical vulnerabilities in its E-Business Suite and PeopleSoft platforms. A newly discovered unauthenticated SQL injection flaw in Oracle EBS allows attackers to execute remote code, potentially compromising sensitive data and operating systems.
Horizon3 researchers reported the issue to Oracle, which patched it during the October release. However, the fix may not fully protect already breached systems, particularly if web shells have been installed.
Meanwhile, ShinyHunters, a notorious cybercriminal group, exploited an Oracle PeopleSoft zero-day vulnerability in May, targeting over 100 organizations predominantly in the education sector. This initial breach was later followed by a significant expansion of their attacks in September, targeting various industries including higher education, technology, and government.
TrendAI's Zero Day Initiative (ZDI) uncovered three distinct vulnerabilities in PeopleSoft, each requiring its own CVE identifier. The first vulnerability is a Server-Side Request Forgery (SSRF) flaw in the PeopleSoft Integration Gateway (PSIGW) which could allow attackers to access vulnerable endpoints and execute remote code. The second and third vulnerabilities involve external control of file path and deserialization of untrusted data, respectively.
These weaknesses could be combined to achieve remote code execution across compromised PeopleSoft instances. Oracle has acknowledged the issues and is working to assign separate CVEs to each problem.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
