CVE-2003-0749

SAP Internet Transaction Server 4620.2.0.323011 - Cross-Site Scripting via ~service Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2003-0749. PoCs published by Martin Eiszner.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in SAP Internet Transaction Server's 'wgate.dll' component. The vulnerability arises from insufficient sanitization of user-supplied input, allowing arbitrary JavaScript execution.

Description

Cross-site scripting (XSS) vulnerability in wgate.dll for SAP Internet Transaction Server (ITS) 4620.2.0.323011 allows remote attackers to insert arbitrary web script and steal cookies via the ~service parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Martin Eiszner · textremotemultiple
https://www.exploit-db.com/exploits/23071

This exploit demonstrates a cross-site scripting (XSS) vulnerability in SAP Internet Transaction Server's 'wgate.dll' component. The vulnerability arises from insufficient sanitization of user-supplied input, allowing arbitrary JavaScript execution.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: SAP Internet Transaction Server (wgate.dll)
No auth needed
Prerequisites: Access to a vulnerable SAP Internet Transaction Server instance
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Vendor Advisory mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2003-08/0361.html
Exploit, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/8517

Scores

EPSS 0.0365
EPSS Percentile 88.1%

Details

Status published
Products (1)
sap/internet_transaction_server 4620.2.0.323011
Published Oct 20, 2003
Tracked Since Feb 18, 2026