CVE-2004-2059
ASPRunner 2.4 - Cross-Site Scripting via SearchFor or SQL Parameters
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2004-2059. PoCs published by Ferruh Mavituna.
AI-analyzed exploit summary The provided text describes multiple vulnerabilities in ASPRunner versions 2.4 and prior, including SQL injection, XSS, information disclosure, and unauthorized database access. It includes a URL demonstrating an XSS attack via the 'SearchFor' parameter.
Description
Multiple cross-site scripting vulnerabilities in ASPRunner 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) SearchFor parameter in [TABLE-NAME]_search.asp, (2) SQL parameter in [TABLE-NAME]_edit.asp, (3) SearchFor parameter in [TABLE]_list.asp, or (4) SQL parameter in export.asp.
Exploits (4)
The provided text describes multiple vulnerabilities in ASPRunner versions 2.4 and prior, including SQL injection, XSS, information disclosure, and unauthorized database access. It includes a URL demonstrating an XSS attack via the 'SearchFor' parameter.
This is a writeup describing multiple vulnerabilities in ASPRunner, including SQL injection, XSS, information disclosure, and unauthorized database access. The provided URL demonstrates an XSS payload in the 'SearchFor' parameter.
This exploit demonstrates an XSS vulnerability in ASPRunner by injecting a malicious script into the 'SQL' parameter of the edit page. The script executes arbitrary JavaScript, potentially stealing cookies or performing other client-side attacks.
This exploit demonstrates an XSS vulnerability in ASPRunner by injecting a script tag into the 'SQL' parameter of the export.asp page. The payload executes arbitrary JavaScript, confirming the vulnerability.