Vulnerabilities > CVE-2018-2636 - Unspecified vulnerability in Oracle Hospitality Simphony 2.7/2.8/2.9
Attack vector
NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security). Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Exploit-Db
| description | Oracle Hospitality Simphony (MICROS) 2.7 < 2.9 - Directory Traversal. CVE-2018-2636. Webapps exploit for Multiple platform |
| file | exploits/multiple/webapps/43960.py |
| id | EDB-ID:43960 |
| last seen | 2018-02-02 |
| modified | 2018-02-02 |
| platform | multiple |
| port | |
| published | 2018-02-02 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/43960/ |
| title | Oracle Hospitality Simphony (MICROS) 2.7 < 2.9 - Directory Traversal |
| type | webapps |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/146229/oraclehs-traversal.txt |
| id | PACKETSTORM:146229 |
| last seen | 2018-02-03 |
| published | 2018-02-03 |
| reporter | Dmitry Chastuhin |
| source | https://packetstormsecurity.com/files/146229/Oracle-Hospitality-Simphony-MICROS-2.9-Directory-Traversal.html |
| title | Oracle Hospitality Simphony (MICROS) 2.9 Directory Traversal |
The Hacker News
| id | THN:042402C1E32C70A88B38F5FF3A7E4DAB |
| last seen | 2018-01-31 |
| modified | 2018-01-31 |
| published | 2018-01-31 |
| reporter | Wang Wei |
| source | https://thehackernews.com/2018/01/oracle-micros-pos.html |
| title | Critical Oracle Micros POS Flaw Affects Over 300,000 Payment Systems |
References
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.securityfocus.com/bid/102560
- https://www.exploit-db.com/exploits/43960/
- https://github.com/erpscanteam/CVE-2018-2636
- https://erpscan.io/press-center/blog/oracle-micros-pos-breached/
- https://erpscan.io/advisories/erpscan-18-002-oracle-micros-pos-missing-authorisation-check/