CVE-2003-0624

BEA WebLogic Server < 8.1 - Cross-Site Scripting via InteractiveQuery.jsp Person Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2003-0624. PoCs published by Corsaire Limited.

AI-analyzed exploit summary The exploit describes a cross-site scripting (XSS) vulnerability in BEA WebLogic's InteractiveQuery.jsp example application. The vulnerability arises from insufficient sanitization of the 'person' parameter, allowing arbitrary script execution in the context of a user's browser.

Description

Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web script via the person parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Corsaire Limited · textwebappsjsp
https://www.exploit-db.com/exploits/23315

The exploit describes a cross-site scripting (XSS) vulnerability in BEA WebLogic's InteractiveQuery.jsp example application. The vulnerability arises from insufficient sanitization of the 'person' parameter, allowing arbitrary script execution in the context of a user's browser.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: BEA WebLogic 8.1 and prior
No auth needed
Prerequisites: A target running a vulnerable version of BEA WebLogic with the InteractiveQuery.jsp example accessible
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/8938
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/13568
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=106761926906781&w=2

Scores

EPSS 0.0344
EPSS Percentile 87.5%

Details

CWE
CWE-79
Status published
Products (2)
bea/weblogic_server 3.1.8
bea/weblogic_server < 8.1
Published Dec 01, 2003
Tracked Since Feb 18, 2026