CVE-2008-2751
Glassfish Server - Multiple Cross-Site Scripting in Webadmin Interface Parameters
Title source: llmExploitation Summary
EIP tracks 7 public exploits for CVE-2008-2751. PoCs published by Eduardo Jorge.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Glassfish by injecting malicious JavaScript into multiple parameters of a specific URL. The payload triggers alert pop-ups, confirming the vulnerability.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, or (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (a) resourceNode/customResourceNew.jsf; the (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, or (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (b) resourceNode/externalResourceNew.jsf; the (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, or (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (c) resourceNode/jmsDestinationNew.jsf; the (13) propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi or (14) propertyForm:propertySheet:generalPropertySheet:descProp:cd parameter to (d) resourceNode/jmsConnectionNew.jsf; the (15) propertyForm:propertySheet:propertSectionTextField:jndiProp:jnditext or (16) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (e) resourceNode/jdbcResourceNew.jsf; the (17) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name, (18) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname, or (19) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder parameter to (f) applications/lifecycleModulesNew.jsf; or the (20) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name, (21) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType, or (22) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db parameter to (g) resourceNode/jdbcConnectionPoolNew1.jsf.
Exploits (7)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Glassfish by injecting malicious JavaScript into multiple parameters of a specific URL. The payload triggers alert pop-ups, confirming the vulnerability.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Glassfish by injecting malicious JavaScript into the JNDI and description parameters of the JMS connection creation page. The payload triggers alert popups, confirming the vulnerability.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Glassfish by injecting malicious JavaScript into the URL parameters. The vulnerability arises due to insufficient sanitization of user-supplied data, allowing arbitrary script execution in the context of the affected site.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Glassfish by injecting malicious JavaScript into multiple parameters of a specific URL. The PoC triggers alert dialogs to prove the vulnerability.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Glassfish by injecting malicious JavaScript into multiple parameters of a specific URL. The PoC triggers alert popups, proving the lack of input sanitization.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Glassfish by injecting malicious JavaScript into multiple parameters of a specific URL. The payload triggers alert dialogs, proving the lack of input sanitization.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Glassfish by injecting malicious JavaScript into multiple parameters of a specific URL. The vulnerability arises due to insufficient sanitization of user-supplied data, allowing arbitrary script execution in the context of the affected site.