CVE-2008-0240

Sun Java System Identity Manager 6.0 SP1-SP3, 7.0, 7.1 - Frame Injection via helpUrl Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-0240. PoCs published by Jan Fry & Adrian Pastor.

AI-analyzed exploit summary The provided text describes an HTML injection and XSS vulnerability in Sun Java System Identity Manager due to inadequate input sanitization. It includes a proof-of-concept URL demonstrating the issue but lacks executable exploit code.

Description

/idm/help/index.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via the helpUrl parameter, aka "frame injection."

Exploits (1)

exploitdb WRITEUP VERIFIED

by Jan Fry & Adrian Pastor · textwebappsjsp

https://www.exploit-db.com/exploits/31006

View Code ZIP pw:eip

The provided text describes an HTML injection and XSS vulnerability in Sun Java System Identity Manager due to inadequate input sanitization. It includes a proof-of-concept URL demonstrating the issue but lacks executable exploit code.

Classification

Writeup 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Theoretical

Target: Sun Java System Identity Manager 6.0 SP1, 6.0 SP2, 6.0 SP3, 7.0, and 7.1

No auth needed

Prerequisites: Access to the vulnerable application

MITRE ATT&CK