RE: [Full-disclosure] XSS in Oracle default fcgi-bin/echo

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

>Hmm... maybe difficult to verify, since I did not post a PoC test.
>Maybe a kind Oracle admin could point me to a patched fcgi-bin/echo?
>Funny if any such existed: an admin careful to keep patches up-to-date, but
>careless in not following security recommendations to remove...
>Maybe, contact me off-list so I can provide PoC?

If you are going to give PoC code to anyone who asks for it, why not just post 
it?   It will be made public anyway.  Or you could apply the patch yourself and 
test on your own and communicate any vulnerabilities that my persist to Oracle 
first.

t