CoreLabs
Source-scoped identity with 4 associated PoCs and 8 linked vulnerabilities.
Exploit catalog results
Showing 4 PoCs on this page
ExploitDBMikroTik RouterOS < 6.41.3/6.42rc27 - SMB Buffer Overflow
ExploitDB exploitPublished 2018-03-15Not analyzedCVE-2018-74451 file
ExploitDBTrend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
ExploitDB exploitPublished 2017-12-19Not analyzedCVE-2017-11398CVE-2017-14094CVE-2017-14095CVE-2017-14096CVE-2017-140971 file
ExploitDBBroadcom BCM4325 / BCM4329 Devices - Denial of Service
ExploitDB exploitPublished 2012-11-15Not analyzedCVE-2012-26191 file
ExploitDBHyperic HQ 3.2 < 4.2-beta1 - Multiple Cross-Site Scripting Vulnerabilities
ExploitDB exploitPublished 2009-10-02WriteupCVE-2009-28981 file
Analysis
Technical assessment
This artifact is a security advisory (CORE-2009-0812) detailing multiple cross-site scripting (XSS) vulnerabilities in Hyperic HQ. It provides a technical description of reflected and stored XSS flaws, including vulnerable code snippets and example URLs, but does not contain executable exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The artifact is a text advisory describing two XSS vulnerabilities (CVE-2009-2897, CVE-2009-2898) in Hyperic HQ. It contains no executable code, no concealed payload, and no instructions for the reader to perform any action beyond applying vendor patches. The PoC examples are standard XSS test strings (e.g., payload withheld) that demonstrate the vulnerability without any backdoor or deceptive behavior.
Classification basis and observed behavior
Classification basis
The artifact is a security advisory containing a technical description of vulnerabilities, including code snippets and example URLs, but it does not provide any functional exploit or scanner code. It is a writeup.
exploits/jsp/webapps/10013.txt:103-104exploits/jsp/webapps/10013.txt:166-171Requirements
- For the stored XSS (CVE-2009-2898), the attacker must be an authenticated Hyperic user to create an alert with a malicious Description.
exploits/jsp/webapps/10013.txt:160-161 - For the reflected XSS (CVE-2009-2897), the attacker must send a crafted request to a vulnerable .do page.
exploits/jsp/webapps/10013.txt:138-143
Observed behavior
- The advisory describes a reflected XSS vulnerability in GenericError.jsp where unsanitized exception data is printed, allowing script injection via crafted numeric parameters.
exploits/jsp/webapps/10013.txt:114-143 - The advisory describes a stored XSS vulnerability in the Alerts list where an authenticated user can inject JavaScript into the Description field, which executes when other users view the Alerts list.
exploits/jsp/webapps/10013.txt:159-174
Behaviors behind the backdoor verdict
Observables
- Xss Payload
- Payload withheldStandard XSS proof-of-concept payload used to demonstrate the stored XSS vulnerability in the Alerts Description field.
exploits/jsp/webapps/10013.txt:170 - Xss Payload
- Payload withheldStandard XSS proof-of-concept payload used in reflected XSS example URLs.
exploits/jsp/webapps/10013.txt:148-153
What the analysis did not establish
- The artifact is a text advisory and does not include any executable code, scripts, or tools.
- The analysis is based solely on the provided text; no external resources or referenced URLs were fetched or analyzed.
- Only the single text file (10013.txt) was reviewed; no external resources or referenced URLs were fetched or analyzed.
- The PGP signature block was not verified and is treated as untrusted metadata.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.