CVE-2006-5114

SAP Internet Transaction Server 6.1-6.2 - Cross-Site Scripting via ~urlmime or ~command Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5114. PoCs published by ILION Research.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in SAP Internet Transaction Server (ITS) versions 6.1 and 6.2. The PoC uses a crafted URL to inject malicious JavaScript code, which executes in the context of the victim's browser.

Description

Multiple cross-site scripting (XSS) vulnerabilities in wgate in SAP Internet Transaction Server (ITS) 6.1 and 6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) ~urlmime or (2) ~command parameter, different vectors than CVE-2003-0749.

Exploits (1)

exploitdb WORKING POC VERIFIED

by ILION Research · textremotemultiple

https://www.exploit-db.com/exploits/28725

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in SAP Internet Transaction Server (ITS) versions 6.1 and 6.2. The PoC uses a crafted URL to inject malicious JavaScript code, which executes in the context of the victim's browser.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: SAP Internet Transaction Server (ITS) 6.1, 6.2

No auth needed

Prerequisites: Victim must visit the crafted URL

MITRE ATT&CK