Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-1634. PoCs published by Gregory Duchemin.
AI-analyzed exploit summary This is a functional XSS exploit for Novell GroupWise WebAccess that bypasses security restrictions by using an obfuscated onload event handler to extract the session token and inject an iframe, modifying the user's signature. The exploit leverages a space character to evade the security parser.
Description
The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, which allows remote attackers to gain access to user accounts via unspecified vectors.
Exploits (1)
This is a functional XSS exploit for Novell GroupWise WebAccess that bypasses security restrictions by using an obfuscated onload event handler to extract the session token and inject an iframe, modifying the user's signature. The exploit leverages a space character to evade the security parser.