### [CVE-2018-2894](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2894)
![](https://img.shields.io/static/v1?label=Product&message=WebLogic%20Server&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%2012.1.3.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20WebLogic%20Server.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20takeover%20of%20Oracle%20WebLogic%20Server.&color=brighgreen)

### Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

### POC

#### Reference
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

#### Github
- https://github.com/0day666/Vulnerability-verification
- https://github.com/0x783kb/Security-operation-book
- https://github.com/0xMrNiko/Awesome-Red-Teaming
- https://github.com/0xT11/CVE-POC
- https://github.com/0xh4di/PayloadsAllTheThings
- https://github.com/0xn0ne/weblogicScanner
- https://github.com/111ddea/cve-2018-2894
- https://github.com/189569400/Meppo
- https://github.com/20142995/pocsuite3
- https://github.com/20142995/sectool
- https://github.com/3vikram/Application-Vulnerabilities-Payloads
- https://github.com/5huai/POC-Test
- https://github.com/84KaliPleXon3/Payloads_All_The_Things
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/Amar224/Pentest-Tools
- https://github.com/AnonVulc/Pentest-Tools
- https://github.com/Aquilao/Toy-Box
- https://github.com/Bywalks/WeblogicScan
- https://github.com/CVEDB/PoC-List
- https://github.com/CVEDB/awesome-cve-repo
- https://github.com/CVEDB/top
- https://github.com/Delishsploits/PayloadsAndMethodology
- https://github.com/Elsfa7-110/kenzer-templates
- https://github.com/GhostTroops/TOP
- https://github.com/GuynnR/Payloads
- https://github.com/H1CH444MREB0RN/PenTest-free-tools
- https://github.com/Hatcat123/my_stars
- https://github.com/ImranTheThirdEye/AD-Pentesting-Tools
- https://github.com/JERRY123S/all-poc
- https://github.com/KimJun1010/WeblogicTool
- https://github.com/LandGrey/CVE-2018-2894
- https://github.com/MacAsure/WL_Scan_GO
- https://github.com/Mehedi-Babu/pentest_tools_repo
- https://github.com/Muhammd/Awesome-Payloads
- https://github.com/N1h1l157/attack_tool
- https://github.com/Nieuport/PayloadsAllTheThings
- https://github.com/ParrotSec-CN/ParrotSecCN_Community_QQbot
- https://github.com/Pav-ksd-pl/PayloadsAllTheThings
- https://github.com/Ra7mo0on/PayloadsAllTheThings
- https://github.com/S3cur3Th1sSh1t/Pentest-Tools
- https://github.com/SexyBeast233/SecBooks
- https://github.com/TSY244/CyberspaceSearchEngine
- https://github.com/Threekiii/Awesome-POC
- https://github.com/Threekiii/Vulhub-Reproduce
- https://github.com/Waseem27-art/ART-TOOLKIT
- https://github.com/Weik1/Artillery
- https://github.com/WingsSec/Meppo
- https://github.com/XPR1M3/Payloads_All_The_Things
- https://github.com/YellowVeN0m/Pentesters-toolbox
- https://github.com/ZTK-009/RedTeamer
- https://github.com/Zero094/Vulnerability-verification
- https://github.com/aiici/weblogicAllinone
- https://github.com/andrysec/PayloadsAllVulnerability
- https://github.com/anhtu97/PayloadAllEverything
- https://github.com/apkadmin/PayLoadsAll
- https://github.com/awake1t/Awesome-hacking-tools
- https://github.com/awsassets/weblogic_exploit
- https://github.com/bakery312/Vulhub-Reproduce
- https://github.com/chanchalpatra/payload
- https://github.com/cqkenuo/Weblogic-scan
- https://github.com/cross2to/betaseclab_tools
- https://github.com/cyberanand1337x/bug-bounty-2022
- https://github.com/cyberharsh/weblogic2894
- https://github.com/d4n-sec/d4n-sec.github.io
- https://github.com/developer3000S/PoC-in-GitHub
- https://github.com/djytmdj/Tool_Summary
- https://github.com/dr0op/WeblogicScan
- https://github.com/elinakrmova/RedTeam-Tools
- https://github.com/emtee40/win-pentest-tools
- https://github.com/falocab/PayloadsAllTheThings
- https://github.com/fengjixuchui/RedTeamer
- https://github.com/forhub2021/weblogicScanner
- https://github.com/hack-parthsharma/Pentest-Tools
- https://github.com/hectorgie/PoC-in-GitHub
- https://github.com/hellochunqiu/PayloadsAllTheThings
- https://github.com/hktalent/TOP
- https://github.com/hmoytx/weblogicscan
- https://github.com/hxysaury/saury-vulnhub
- https://github.com/iceberg-N/WL_Scan_GO
- https://github.com/jared1981/More-Pentest-Tools
- https://github.com/jas502n/CVE-2018-2894
- https://github.com/jbmihoub/all-poc
- https://github.com/jiangsir404/POC-S
- https://github.com/jwxa2015/pocs
- https://github.com/k8gege/Aggressor
- https://github.com/k8gege/Ladon
- https://github.com/k8gege/PowerLadon
- https://github.com/k8gege/PyLadon
- https://github.com/kdandy/pentest_tools
- https://github.com/kenuoseclab/Weblogic-scan
- https://github.com/koutto/jok3r-pocs
- https://github.com/ksw9722/PayloadsAllTheThings
- https://github.com/langu-xyz/JavaVulnMap
- https://github.com/lnick2023/nicenice
- https://github.com/lp008/Hack-readme
- https://github.com/merlinepedra/Pentest-Tools
- https://github.com/merlinepedra25/Pentest-Tools
- https://github.com/merlinepedra25/Pentest-Tools-1
- https://github.com/mrhacker51/ReverseShellCommands
- https://github.com/nevidimk0/PayloadsAllTheThings
- https://github.com/nitishbadole/Pentest_Tools
- https://github.com/password520/RedTeamer
- https://github.com/pathakabhi24/Pentest-Tools
- https://github.com/pjgmonteiro/Pentest-tools
- https://github.com/pwnagelabs/VEF
- https://github.com/qazbnm456/awesome-cve-poc
- https://github.com/qi4L/WeblogicScan.go
- https://github.com/rabbitmask/WeblogicScan
- https://github.com/rabbitmask/WeblogicScanLot
- https://github.com/ranjan-prp/PayloadsAllTheThings
- https://github.com/ravijainpro/payloads_xss
- https://github.com/retr0-13/Pentest-Tools
- https://github.com/safe6Sec/WeblogicVuln
- https://github.com/severnake/Pentest-Tools
- https://github.com/sobinge/--1
- https://github.com/sobinge/PayloadsAllTheThings
- https://github.com/sobinge/PayloadsAllThesobinge
- https://github.com/sponkmonk/Ladon_english_update
- https://github.com/superfish9/pt
- https://github.com/superlink996/chunqiuyunjingbachang
- https://github.com/tdcoming/Vulnerability-engine
- https://github.com/theyoge/AD-Pentesting-Tools
- https://github.com/tomoyamachi/gocarts
- https://github.com/trganda/starrlist
- https://github.com/veo/vscan
- https://github.com/weeka10/-hktalent-TOP
- https://github.com/whoadmin/pocs
- https://github.com/winterwolf32/PayloadsAllTheThings
- https://github.com/wr0x00/Lizard
- https://github.com/wr0x00/Lsploit
- https://github.com/xbl3/awesome-cve-poc_qazbnm456
- https://github.com/xiaoyaovo/2021SecWinterTask
- https://github.com/yaklang/vulinone
- https://github.com/yyzsec/2021SecWinterTask
- https://github.com/zema1/oracle-vuln-crawler
- https://github.com/zzwlpx/weblogic