ID
VAR-E-200511-0203
CVE
| cve_id: | CVE-2005-3635 | Trust: 1.6 |
EDB ID
26487
TITLE
SAP Web Application Server 6.x/7.0 - 'frameset.htm?sap-syscmd' Cross-Site Scripting - PHP webapps Exploit
Trust: 0.6
DESCRIPTION
SAP Web Application Server 6.x/7.0 - 'frameset.htm?sap-syscmd' Cross-Site Scripting. CVE-2005-3635CVE-20716 . webapps exploit for PHP platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | sap | model: | web application server | scope: | eq | version: | 6.x/7.0 | Trust: 1.0 |
| vendor: | sap | model: | web application server | scope: | eq | version: | 7.0 | Trust: 0.3 |
| vendor: | sap | model: | web application server | scope: | eq | version: | 6.40 | Trust: 0.3 |
| vendor: | sap | model: | web application server | scope: | eq | version: | 6.20 | Trust: 0.3 |
| vendor: | sap | model: | web application server | scope: | eq | version: | 6.10 | Trust: 0.3 |
EXPLOIT
source: https://www.securityfocus.com/bid/15361/info
SAP Web Application Server is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
This issue only affects the BSP runtime of SAP WAS.
http://www.example.com/sap/bc/BSp/sap/menu/fameset.htm?sap-sessioncmd=open&sap-syscmd=%3Cscript%3Ealert('xss')%3C/script%3E
Trust: 1.0
EXPLOIT LANGUAGE
txt
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
'frameset.htm?sap-syscmd' Cross-Site Scripting
Trust: 1.0
CREDITS
Leandro Meiners
Trust: 0.6
EXTERNAL IDS
| db: | BID | id: | 15361 | Trust: 1.9 |
| db: | NVD | id: | CVE-2005-3635 | Trust: 1.6 |
| db: | EXPLOIT-DB | id: | 26487 | Trust: 1.6 |
| db: | EDBNET | id: | 48460 | Trust: 0.6 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2005-3635 | Trust: 1.6 |
| url: | https://www.securityfocus.com/bid/15361/info | Trust: 1.0 |
| url: | https://www.exploit-db.com/exploits/26487/ | Trust: 0.6 |
| url: | http://www.sap.com | Trust: 0.3 |
SOURCES
| db: | BID | id: | 15361 |
| db: | EXPLOIT-DB | id: | 26487 |
| db: | EDBNET | id: | 48460 |
LAST UPDATE DATE
2022-07-27T09:23:31.049000+00:00
SOURCES UPDATE DATE
| db: | BID | id: | 15361 | date: | 2005-11-09T00:00:00 |
SOURCES RELEASE DATE
| db: | BID | id: | 15361 | date: | 2005-11-09T00:00:00 |
| db: | EXPLOIT-DB | id: | 26487 | date: | 2005-11-09T00:00:00 |
| db: | EDBNET | id: | 48460 | date: | 2005-11-09T00:00:00 |