Oracle iStore CVE-2025-53041

Exploitation targets the Shopping Cart component of Oracle iStore (Oracle E-Business Suite versions 12.2.5 through 12.2.14) over HTTP and does not require authentication (PR:N). The decisive limiting factor is mandatory human interaction from a person other than the attacker (UI:R) - a victim must click a crafted link or interact with attacker-supplied content, so the attack cannot be fully automated and realistically depends on social engineering/phishing delivery. Impact is bounded to limited (C:L/I:L) read and update/insert/delete on a subset of iStore data with no availability impact, though the scope change (S:C) means effects may extend to additional Oracle EBS products. Restricted to deployments running the affected 12.2.x iStore versions with the iStore module exposed.

This is a moderate-severity, lower-priority issue despite affecting a widely-deployed enterprise platform. The CVSS 3.1 base score is 6.1 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N: network-reachable and unauthenticated (PR:N), but it REQUIRES human interaction (UI:R) and yields only partial confidentiality and integrity impact with no availability impact (C:L/I:L/A:N). The scope change (S:C) is the main aggravating factor - Oracle explicitly notes attacks may significantly impact additional products beyond iStore. Exploitation signals are weak: EPSS is 0.23% (13th percentile), it is NOT listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The profile (UI:R, S:C, C:L/I:L, A:N, unauthenticated, HTTP) is highly characteristic of a cross-site scripting / content-injection style flaw rather than a direct server compromise, which is in tension with the input Tag 'Authentication Bypass' and the broad CWE-284 (Improper Access Control) classification - verify the true weakness class with Oracle. Overall: a real but second-tier patch item - prioritize after any critical/KEV Oracle EBS flaws from the same CPU, since the required user interaction and low per-system impact limit real-world weaponization to targeted phishing-style delivery.

An unauthenticated attacker crafts a malicious link or request targeting the Oracle iStore Shopping Cart component and lures a legitimate user (customer or operator) into interacting with it, since successful attacks require human interaction (UI:R). When the victim's browser processes the crafted content, the attacker gains unauthorized read of a subset of data and limited update/insert/delete access, with effects potentially spilling into additional products due to the scope change. No public exploit code is identified at time of analysis.