{"uuid": "bef728b1-384d-4254-aa8c-535915fb0ebd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61882", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"watchTowr (Sonny, Sina Kheirkhah, Jake Knott)\", \"Mathieu Dupas\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2025-61882 in Oracle E-Business Suite\\n          by combining SSRF, Path Traversal, HTTP request smuggling and XSLT injection.\\n\\n          The exploit hosts a malicious XSL file\\n          that the target will fetch and process, leading to RCE.\\n\\n          This module provides an interactive shell session.\\n          Vulnerable versions affected are 12.2.3-12.2.14.\", \"disclosure_date\": \"2025-10-04\", \"fullname\": \"exploit/multi/http/oracle_ebs_cve_2025_61882_exploit_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:58 +0000\", \"name\": \"Oracle E-Business Suite CVE-2025-61882 RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/oracle_ebs_cve_2025_61882_exploit_rce\", \"references\": [\"CVE-2025-61882\", \"URL-https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/\", \"URL-https://www.oracle.com/security-alerts/alert-cve-2025-61882.html\"], \"rport\": 8000, \"session_types\": false, \"targets\": [\"Linux/Unix (Interactive Shell)\", \"Windows (Interactive Shell)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:06.453526Z"}