CVE-2003-0413

Sun ONE Application Server 7.0 and Java System Web Server 6.1 - Cross-Site Scripting via Invalid JSP File Error

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2003-0413. PoCs published by SPI Labs.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun ONE Application Server by injecting a malicious script into a URL parameter. The script executes in the context of the user's browser when visiting the crafted link.

Description

Cross-site scripting (XSS) vulnerability in the webapps-simple sample application for (1) Sun ONE Application Server 7.0 for Windows 2000/XP or (2) Sun Java System Web Server 6.1 allows remote attackers to insert arbitrary web script or HTML via an HTTP request that generates an "Invalid JSP file" error, which inserts the text in the resulting error message.

Exploits (1)

exploitdb WORKING POC VERIFIED

by SPI Labs · textremotewindows

https://www.exploit-db.com/exploits/22665

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun ONE Application Server by injecting a malicious script into a URL parameter. The script executes in the context of the user's browser when visiting the crafted link.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Sun ONE Application Server 6.1, 6.1 Service Pack 1, and 7.0

No auth needed

Prerequisites: Vulnerable Sun ONE Application Server with the 'webapps-simple' sample application enabled

MITRE ATT&CK