1## autogenerated on 2025-10-09 07:53:02
2name: crowdsecurity/vpatch-CVE-2025-61882
3description: 'Detects Oracle E-Business Suite 12.2.3–12.2.14 LFI and SSRF/RCE via ieshostedsurvey.jsp and UiServlet endpoints.'
4rules:
5  - and:
6      - zones:
7          - URI
8        transform:
9          - urldecode
10          - lowercase
11        match:
12          type: contains
13          value: /oa_html/help/../ieshostedsurvey.jsp
14  - and:
15      - zones:
16          - URI
17        transform:
18          - urldecode
19          - lowercase
20        match:
21          type: contains
22          value: /oa_html/configurator/uiservlet
23      - zones:
24          - BODY_ARGS
25        variables:
26          - getuitype
27        transform:
28          - urldecode
29          - lowercase
30        match:
31          type: contains
32          value: 'ieshostedsurvey.jsp'
33
34labels:
35  type: exploit
36  service: http
37  confidence: 3
38  spoofable: 0
39  behavior: 'http:exploit'
40  label: 'Oracle E-Business Suite - RCE'
41  classification:
42    - cve.CVE-2025-61882
43    - attack.T1190
44    - cwe.CWE-94
45