CVE-2025-30746: Oracle iStore Auth Bypass Vulnerability

CVE-2025-30746 Overview

CVE-2025-30746 is a vulnerability in the Shopping Cart component of Oracle iStore, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.14. An unauthenticated attacker with network access via HTTP can exploit the issue, but successful attacks require interaction from a user other than the attacker. The vulnerability carries a scope change, meaning exploitation can affect resources beyond Oracle iStore. Oracle categorizes the weaknesses as [CWE-79] (Cross-Site Scripting) and [CWE-352] (Cross-Site Request Forgery). Successful exploitation results in unauthorized create, update, and delete access, along with unauthorized read access to a subset of Oracle iStore data.

Critical Impact
Unauthenticated attackers can trick authenticated iStore users into triggering malicious requests, leading to unauthorized modification and disclosure of data across trust boundaries.

Affected Products

Oracle iStore 12.2.3 through 12.2.14
Oracle E-Business Suite deployments containing the iStore Shopping Cart component
Internet-facing Oracle iStore storefronts serving authenticated customers

Discovery Timeline

2025-07-15 - CVE-2025-30746 published to NVD alongside the Oracle Critical Patch Update
2025-07-15 - Oracle publishes security fix in the Oracle Critical Patch Update Advisory - July 2025
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30746

Vulnerability Analysis

The flaw resides in the Shopping Cart component of Oracle iStore, a customer-facing storefront built on Oracle E-Business Suite. The combination of [CWE-79] and [CWE-352] indicates the component fails to properly neutralize user-controlled input rendered back to the browser and does not validate the origin of state-changing HTTP requests. Attackers exploit the issue remotely over HTTP without authentication, but the attack chain depends on a victim user interacting with a crafted link or page. Because the vulnerability crosses a security scope, injected content or forged requests running in the victim's browser can act on resources outside of iStore itself. This creates a pathway for account manipulation, cart tampering, and disclosure of session-accessible data belonging to other customers or administrators.

Root Cause

The underlying issues stem from missing output encoding on parameters rendered in Shopping Cart responses and absent anti-CSRF tokens on state-changing endpoints. When attacker-controlled input reaches HTML or JavaScript sinks without contextual escaping, arbitrary script executes in the victim's session. In parallel, endpoints that create, update, or delete cart data accept cross-origin requests carrying the victim's session cookie, enabling forgery.

Attack Vector

An attacker crafts a malicious URL or third-party web page targeting the vulnerable iStore endpoint. When an authenticated iStore user visits the attacker-controlled resource, the browser either executes injected script within the iStore origin or submits a state-changing request using the victim's credentials. No prior privileges are required by the attacker, and the network path is HTTP or HTTPS to the storefront.

No public proof-of-concept code is available. Refer to the Oracle Critical Patch Update Advisory - July 2025 for vendor-supplied technical guidance.

Detection Methods for CVE-2025-30746

Indicators of Compromise

HTTP requests to Oracle iStore Shopping Cart URLs containing HTML entities, <script> fragments, javascript: schemes, or unusual encoded payloads in query parameters or POST bodies.
Referer headers on state-changing iStore requests originating from domains unrelated to the storefront.
Unexpected cart modifications, order changes, or profile updates performed by authenticated users shortly after clicking external links.

Detection Strategies

Deploy web application firewall rules that flag reflected script patterns and CSRF-style cross-origin POST requests targeting /OA_HTML/ and iStore Shopping Cart endpoints.
Correlate application logs with browser telemetry to identify sessions where DOM script execution follows navigation from external referrers.
Hunt for anomalous sequences where a single user session performs bulk cart, wishlist, or account changes within seconds of an inbound HTTP referral.

Monitoring Recommendations

Enable and centrally forward Oracle E-Business Suite access and application logs to a SIEM for retention and query.
Track patch levels of iStore instances against the July 2025 Oracle Critical Patch Update baseline.
Monitor Content Security Policy violation reports if CSP is enabled on the storefront to catch injection attempts early.

How to Mitigate CVE-2025-30746

Immediate Actions Required

Apply the July 2025 Oracle Critical Patch Update to all Oracle iStore instances running versions 12.2.3 through 12.2.14.
Inventory internet-facing iStore deployments and prioritize patching for storefronts handling authenticated customer sessions.
Review recent Shopping Cart activity logs for signs of forged requests or injected content since the disclosure date.

Patch Information

Oracle addressed CVE-2025-30746 in the July 2025 Critical Patch Update. Administrators should download and apply the fixes documented in the Oracle Critical Patch Update Advisory - July 2025 following Oracle's standard E-Business Suite patching procedures.

Workarounds

Restrict access to Oracle iStore administrative and cart endpoints through network segmentation and reverse proxy allow-lists until patching completes.
Deploy a web application firewall with signatures for reflected XSS and CSRF patterns targeting Oracle E-Business Suite URLs.
Enforce a strict Content Security Policy and SameSite=Strict session cookies on the storefront to reduce exploitability of injected script and cross-site requests.
Communicate awareness guidance to iStore users, cautioning against clicking untrusted links while authenticated to the storefront.