CVE-2005-0873

Oracle Reports Server 10g (9.0.4.3.3) - Cross-Site Scripting via test.jsp Parameters

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-0873. PoCs published by Paolo.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Oracle Reports Server by injecting arbitrary JavaScript code via unsanitized input parameters in the test.jsp page. The PoC shows how an attacker can execute script code in the context of a user's browser session.

Description

Multiple cross-site scripting (XSS) vulnerabilities in test.jsp in Oracle Reports Server 10g (9.0.4.3.3) allow remote attackers to inject arbitrary web script or HTML via the (1) desname or (2) repprod parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Paolo · textwebappsjsp

https://www.exploit-db.com/exploits/25269

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Oracle Reports Server by injecting arbitrary JavaScript code via unsanitized input parameters in the test.jsp page. The PoC shows how an attacker can execute script code in the context of a user's browser session.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Oracle Reports Server (version not specified)

No auth needed

Prerequisites: Access to the vulnerable Oracle Reports Server instance

MITRE ATT&CK