SAP Internet Transaction Server多个跨站脚本攻击(XSS)漏洞

https://www.exploit-db.com/exploits/28725
https://cxsecurity.com/issue/WLB-2006100031
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200610-034

SAPInternetTransactionServer(ITS)6.1和6.2的wgate中的多个跨站脚本攻击(XSS)漏洞。远程攻击者可以通过(1)~urlmime或(2)~command参数注入任意Web脚本或HTML。

source: http://www.securityfocus.com/bid/20244/info

SAP Internet Transaction Server (ITS) is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue would allow an attacker to steal cookie-based credentials and to launch other attacks.

Versions 6.1 and 6.2 are reportedly vulnerable; other versions may also be affected.

http://www.example.com/scripts/wgate/!?~urlmime=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E%3Cimg%20src=%22

来源:BID
名称:20244
链接:http://www.securityfocus.com/bid/20244
来源:BUGTRAQ
名称:20060928SAPInternetTransactionServerXSSvulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/447262/100/0/threaded
来源:XF
名称:sapits-login-xss(29245)
链接:http://xforce.iss.net/xforce/xfdb/29245
来源:VUPEN
名称:ADV-2006-3894
链接:http://www.frsirt.com/english/advisories/2006/3894
来源:SREASON
名称:1665
链接:http://securityreason.com/securityalert/1665
来源:SECUNIA
名称:22171
链接:http://secunia.com/advisories/22171