CVE-2009-2898

Hyperic HQ 3.2 < 4.2-beta1 - Multiple Cross-Site Scripting Vulnerabilities

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-2898 has a selected CVSS score of 3.5; EIP currently links 1 catalogued exploit.

Description

Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBHyperic HQ 3.2 < 4.2-beta1 - Multiple Cross-Site Scripting VulnerabilitiesExploitDB exploitby CoreLabsWriteup1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This artifact is a security advisory (CORE-2009-0812) detailing multiple cross-site scripting (XSS) vulnerabilities in Hyperic HQ. It provides a technical description of reflected and stored XSS flaws, including vulnerable code snippets and example URLs, but does not contain executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a text advisory describing two XSS vulnerabilities (CVE-2009-2897, CVE-2009-2898) in Hyperic HQ. It contains no executable code, no concealed payload, and no instructions for the reader to perform any action beyond applying vendor patches. The PoC examples are standard XSS test strings (e.g., payload withheld) that demonstrate the vulnerability without any backdoor or deceptive behavior.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
LanguagesEnglish
Target softwareHyperic HQ
Attack typesCross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a security advisory containing a technical description of vulnerabilities, including code snippets and example URLs, but it does not provide any functional exploit or scanner code. It is a writeup.

exploits/jsp/webapps/10013.txt:103-104exploits/jsp/webapps/10013.txt:166-171

Requirements

  • For the stored XSS (CVE-2009-2898), the attacker must be an authenticated Hyperic user to create an alert with a malicious Description.exploits/jsp/webapps/10013.txt:160-161
  • For the reflected XSS (CVE-2009-2897), the attacker must send a crafted request to a vulnerable .do page.exploits/jsp/webapps/10013.txt:138-143

Observed behavior

  • The advisory describes a reflected XSS vulnerability in GenericError.jsp where unsanitized exception data is printed, allowing script injection via crafted numeric parameters.exploits/jsp/webapps/10013.txt:114-143
  • The advisory describes a stored XSS vulnerability in the Alerts list where an authenticated user can inject JavaScript into the Description field, which executes when other users view the Alerts list.exploits/jsp/webapps/10013.txt:159-174
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Xss Payload
Payload withheldStandard XSS proof-of-concept payload used to demonstrate the stored XSS vulnerability in the Alerts Description field.exploits/jsp/webapps/10013.txt:170
Xss Payload
Payload withheldStandard XSS proof-of-concept payload used in reflected XSS example URLs.exploits/jsp/webapps/10013.txt:148-153
Review boundaries

What the analysis did not establish

  • The artifact is a text advisory and does not include any executable code, scripts, or tools.
  • The analysis is based solely on the provided text; no external resources or referenced URLs were fetched or analyzed.
  • Only the single text file (10013.txt) was reviewed; no external resources or referenced URLs were fetched or analyzed.
  • The PGP signature block was not verified and is treated as untrusted metadata.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

10