CVE-2010-3893
IBM OmniFind Enterprise Edition 8.x and 9.x - Session Impersonation via Stolen Cookie
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-3893. PoCs published by Fatih Kilic.
AI-analyzed exploit summary The exploit demonstrates a reflected XSS vulnerability in IBM OmniFind by injecting a malicious script into the 'command' parameter of the 'collection.do' endpoint. The script executes in the context of the affected site, potentially stealing cookies or performing other malicious actions.
Description
The administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x does not restrict use of a session ID (aka SID) value to a single IP address, which allows remote attackers to perform arbitrary administrative actions by leveraging cookie theft, related to a "session impersonation" issue.
Exploits (1)
The exploit demonstrates a reflected XSS vulnerability in IBM OmniFind by injecting a malicious script into the 'command' parameter of the 'collection.do' endpoint. The script executes in the context of the affected site, potentially stealing cookies or performing other malicious actions.