CVE-2007-3613

SAP Internet Graphics Server - Cross-Site Scripting via ADM:GETLOGFILE PARAMS Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-3613. PoCs published by Mark Litchfield.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in SAP Internet Graphics Server by injecting a script tag into the PARAMS parameter of the ADM:GETLOGFILE endpoint. The vulnerability arises due to insufficient input sanitization, allowing arbitrary JavaScript execution in the context of the affected website.

Description

Cross-site scripting (XSS) vulnerability in ADM:GETLOGFILE in SAP Internet Graphics Service (IGS) allows remote attackers to inject arbitrary web script or HTML via the PARAMS parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Mark Litchfield · textremotemultiple

https://www.exploit-db.com/exploits/30279

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in SAP Internet Graphics Server by injecting a script tag into the PARAMS parameter of the ADM:GETLOGFILE endpoint. The vulnerability arises due to insufficient input sanitization, allowing arbitrary JavaScript execution in the context of the affected website.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: SAP Internet Graphics Server

No auth needed

Prerequisites: Access to the vulnerable SAP Internet Graphics Server endpoint

MITRE ATT&CK