Exploitation Summary
EIP tracks 2 public exploits for CVE-2012-4751. PoCs published by Mike Eduard.
AI-analyzed exploit summary This Python script demonstrates a stored XSS vulnerability in OTRS by sending an email with a malicious iframe payload. The exploit leverages the HTML email rendering feature to execute arbitrary JavaScript in the victim's browser.
Description
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element.
Exploits (2)
This Python script demonstrates a stored XSS vulnerability in OTRS by sending an email with a malicious iframe payload. The exploit leverages the HTML email rendering feature to execute arbitrary JavaScript in the victim's browser.
This exploit demonstrates a stored XSS vulnerability in OTRS 3.1.8 and 3.1.9 by sending a malicious HTML email payload via SMTP. The payload bypasses input validation to execute arbitrary JavaScript in the victim's browser.