CVE-2009-1218

Sun Java System Calendar Server 6 2004Q2-6.3-7.01 - Cross-Site Scripting via login.wcap fmt-out Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-1218. PoCs published by SCS team.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Java System Calendar Server by injecting arbitrary JavaScript code via the 'date' parameter in a crafted URL. The vulnerability arises due to insufficient sanitization of user-supplied input.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allow remote attackers to inject arbitrary web script or HTML via (1) the fmt-out parameter to login.wcap or (2) the date parameter to command.shtml.

Exploits (1)

exploitdb WORKING POC VERIFIED

by SCS team · textwebappsjava

https://www.exploit-db.com/exploits/32862

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Java System Calendar Server by injecting arbitrary JavaScript code via the 'date' parameter in a crafted URL. The vulnerability arises due to insufficient sanitization of user-supplied input.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Sun Java System Calendar Server

No auth needed

Prerequisites: Access to a vulnerable instance of Sun Java System Calendar Server · A victim user to click on the crafted URL

MITRE ATT&CK