Hyperic HQ 3.2 < 4.2-beta1 - Multiple Cross-Site Scripting Vulnerabilities

ExploitDBExploitDB exploitWriteupEDB-10013

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This artifact is a security advisory (CORE-2009-0812) detailing multiple cross-site scripting (XSS) vulnerabilities in Hyperic HQ. It provides a technical description of reflected and stored XSS flaws, including vulnerable code snippets and example URLs, but does not contain executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a text advisory describing two XSS vulnerabilities (CVE-2009-2897, CVE-2009-2898) in Hyperic HQ. It contains no executable code, no concealed payload, and no instructions for the reader to perform any action beyond applying vendor patches. The PoC examples are standard XSS test strings (e.g., <script>alert(document.cookie)</script>) that demonstrate the vulnerability without any backdoor or deceptive behavior.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
LanguagesEnglish
Target softwareHyperic HQ
Attack typesCross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a security advisory containing a technical description of vulnerabilities, including code snippets and example URLs, but it does not provide any functional exploit or scanner code. It is a writeup.

exploits/jsp/webapps/10013.txt:103-104exploits/jsp/webapps/10013.txt:166-171

Requirements

  • For the stored XSS (CVE-2009-2898), the attacker must be an authenticated Hyperic user to create an alert with a malicious Description.exploits/jsp/webapps/10013.txt:160-161
  • For the reflected XSS (CVE-2009-2897), the attacker must send a crafted request to a vulnerable .do page.exploits/jsp/webapps/10013.txt:138-143

Observed behavior

  • The advisory describes a reflected XSS vulnerability in GenericError.jsp where unsanitized exception data is printed, allowing script injection via crafted numeric parameters.exploits/jsp/webapps/10013.txt:114-143
  • The advisory describes a stored XSS vulnerability in the Alerts list where an authenticated user can inject JavaScript into the Description field, which executes when other users view the Alerts list.exploits/jsp/webapps/10013.txt:159-174
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Xss Payload
<script>alert(document.cookie)</script>Standard XSS proof-of-concept payload used to demonstrate the stored XSS vulnerability in the Alerts Description field.exploits/jsp/webapps/10013.txt:170
Xss Payload
<script>alert(document.cookie)</script>Standard XSS proof-of-concept payload used in reflected XSS example URLs.exploits/jsp/webapps/10013.txt:148-153
Review boundaries

What the analysis did not establish

  • The artifact is a text advisory and does not include any executable code, scripts, or tools.
  • The analysis is based solely on the provided text; no external resources or referenced URLs were fetched or analyzed.
  • Only the single text file (10013.txt) was reviewed; no external resources or referenced URLs were fetched or analyzed.
  • The PGP signature block was not verified and is treated as untrusted metadata.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1