CVE-2005-4485

ProjectApp < 3.3 - Cross-Site Scripting via Multiple Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 7 public exploits for CVE-2005-4485. PoCs published by r0t.

AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in ProjectApp, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code into the 'keywords' parameter.

Description

Multiple cross-site scripting (XSS) vulnerabilities in ProjectApp 3.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the keywords parameter to (1) forums.asp, (2) search_employees.asp, (3) cat.asp, and (4) links.asp; (5) projectid parameter to pmprojects.asp, (6) ret_page parameter to login.asp, and (7) skin_number parameter to default.asp.

Exploits (7)

exploitdb WRITEUP VERIFIED
by r0t · textwebappscgi
https://www.exploit-db.com/exploits/26933

The provided text describes a cross-site scripting (XSS) vulnerability in ProjectApp, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code into the 'keywords' parameter.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: ProjectApp (version not specified)
No auth needed
Prerequisites: Access to the vulnerable application URL
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by r0t · textwebappsasp
https://www.exploit-db.com/exploits/26931

The provided text describes a cross-site scripting (XSS) vulnerability in ProjectApp, where user-supplied input is not properly sanitized. It includes an example URL demonstrating the vulnerability but lacks executable exploit code.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: ProjectApp (version not specified)
No auth needed
Prerequisites: Access to the vulnerable application
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by r0t · textwebappsasp
https://www.exploit-db.com/exploits/26934

The provided text describes a cross-site scripting (XSS) vulnerability in ProjectApp, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code into the 'projectid' parameter.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: ProjectApp (version not specified)
No auth needed
Prerequisites: Access to the vulnerable application URL
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by r0t · textwebappsasp
https://www.exploit-db.com/exploits/26935

The provided text describes a cross-site scripting (XSS) vulnerability in ProjectApp due to improper input sanitization. It includes a sample URL demonstrating the vulnerability but lacks executable exploit code.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: ProjectApp (version unspecified)
No auth needed
Prerequisites: Access to a vulnerable instance of ProjectApp · Ability to craft a malicious URL
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by r0t · textwebappsasp
https://www.exploit-db.com/exploits/26930

The provided text describes a cross-site scripting (XSS) vulnerability in ProjectApp, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code into the 'keywords' parameter.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: ProjectApp (version not specified)
No auth needed
Prerequisites: Access to the vulnerable application URL
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by r0t · textwebappsasp
https://www.exploit-db.com/exploits/26936

The provided text describes a cross-site scripting (XSS) vulnerability in ProjectApp due to improper input sanitization. It includes an example URL demonstrating the vulnerability but lacks executable exploit code.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: ProjectApp (version not specified)
No auth needed
Prerequisites: Access to a vulnerable instance of ProjectApp · Ability to craft a malicious URL with XSS payload
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by r0t · textwebappsasp
https://www.exploit-db.com/exploits/26932

The provided text describes a cross-site scripting (XSS) vulnerability in ProjectApp, where user-supplied input is not properly sanitized. An attacker can exploit this by injecting arbitrary script code into the 'keywords' parameter of the 'cat.asp' page.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: ProjectApp (version not specified)
No auth needed
Prerequisites: Access to the vulnerable 'cat.asp' page
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (11)

Core 11
Core References
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/21964
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2005/3040
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/21965
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/18199
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/21966
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/21963
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/21962
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/21967
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/16011
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/21968

Scores

EPSS 0.0273
EPSS Percentile 84.1%

Details

CWE
CWE-79
Status published
Products (1)
iatek/projectapp < 3.3
Published Dec 22, 2005
Tracked Since Feb 18, 2026