CVE-2005-3634
NUCLEISAP Web Application Server 6.10-7.00 - Unauthenticated Session Termination and Open Redirect
Title source: manualExploitation Summary
EIP tracks 1 public exploit for CVE-2005-3634. PoCs published by Leandro Meiners. A Nuclei detection template is also available.
AI-analyzed exploit summary The provided text describes a URI redirection vulnerability in SAP Web Application Server, where the 'sap-exiturl' parameter can be manipulated to redirect users to malicious sites. This can be exploited for phishing or theft of authentication credentials.
Description
frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.
Exploits (1)
The provided text describes a URI redirection vulnerability in SAP Web Application Server, where the 'sap-exiturl' parameter can be manipulated to redirect users to malicious sites. This can be exploited for phishing or theft of authentication credentials.
Nuclei Templates (1)
html:"SAP Business Server Pages Team" || http.html:"sap business server pages team"
body="sap business server pages team"