CVE-2011-4024

OCS Inventory NG < 2.0.1 - Cross-Site Scripting

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-4024. PoCs published by Nicolas DEROUET.

AI-analyzed exploit summary This is a writeup describing a persistent XSS vulnerability in OCS Inventory NG 2.0.1 and prior. The vulnerability allows an attacker to inject malicious HTML/JS through the computer description field, which is then rendered in the admin panel.

Description

Cross-site scripting (XSS) vulnerability in ocsinventory in OCS Inventory NG 2.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Exploits (1)

exploitdb WRITEUP

by Nicolas DEROUET · textwebappswindows

https://www.exploit-db.com/exploits/18005

View Code ZIP pw:eip

This is a writeup describing a persistent XSS vulnerability in OCS Inventory NG 2.0.1 and prior. The vulnerability allows an attacker to inject malicious HTML/JS through the computer description field, which is then rendered in the admin panel.

Classification

Writeup 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: OCS Inventory NG 2.0.1 and prior

No auth needed

Prerequisites: Access to modify the computer description field on a system with OCS Agent installed

MITRE ATT&CK