CVE-2009-4234

Micronet SP1910 Data Access Controller UI - Cross-Site Scripting / HTML Code Injection

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-4234 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit.

Description

Cross-site scripting (XSS) vulnerability in loginpages/error_user.shtml on the Micronet Network Access Controller SP1910 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBMicronet SP1910 Data Access Controller UI - Cross-Site Scripting / HTML Code InjectionExploitDB exploitby K053Stub1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact describes an XSS vulnerability in the Micronet SP1910 UI and provides a single example URL with a script tag injected into the 'msg' parameter. It does not contain any functional exploit code, scanner logic, or a substantive technical writeup. The content is limited to a brief description and a non-executable proof-of-concept URL, making it a stub.

Backdoor review

No backdoor observed in reviewed code

The artifact is a plain-text Proof-of-Concept (PoC) describing a reflected Cross-Site Scripting (XSS) vulnerability in the Micronet SP1910 UI. It contains no executable code, no obfuscated payloads, and no instructions for the reviewer to perform any action beyond viewing the example URL. The PoC simply demonstrates injecting a benign <script>alert('xss')</script> payload into a vulnerable parameter.

ClassificationStub
Model confidence95%
AuthenticationUnknown
LanguagesEnglish
Target softwareMicronet SP1910 Network Access Controller
Attack typescross-site scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains only a description of the vulnerability and a single non-executable URL example. It lacks functional exploit code, scanner logic, or a detailed technical analysis, fitting the definition of a stub.

exploits/hardware/webapps/10247.txt:1-22

Requirements

  • The attacker must be able to craft a URL with a malicious script in the 'msg' parameter and deliver it to a victim.exploits/hardware/webapps/10247.txt:22

Observed behavior

  • The provided URL includes a script tag that would execute an alert if the parameter is reflected without sanitization.exploits/hardware/webapps/10247.txt:22
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldExample URL demonstrating the XSS vulnerability by injecting a benign alert script into the 'msg' parameter.exploits/hardware/webapps/10247.txt:22
Review boundaries

What the analysis did not establish

  • The artifact is a single text file with no executable code; the provided URL is a static example and not a functional exploit or scanner.
  • Review is limited to the supplied text file; no external resources referenced in the file (e.g., vendor URL) were fetched or analyzed.
  • The artifact is a PoC for a web application vulnerability; the benign nature of the example payload does not guarantee the safety of the live target if tested.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3