Menu

Search for hundreds of thousands of exploits

"SAP Internet Transaction Server 6200.1017.50954.0 Bu (WGate) - 'wgate.dll?~service' Cross-Site Scripting"

Author

Exploit author

Portcullis

Platform

Exploit platform

cgi

Release date

Exploit published date

2008-05-08

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
source: https://www.securityfocus.com/bid/29103/info

SAP Internet Transaction Server is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect ITS 6200.1017.50954.0, Build 730827 (win32/IIS 5.0).


http://www.example.com/scripts/wgate.dll?~service=--><img%09src=javascript:alert(xss)
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-11-19 "Gemtek WVRTM-127ACN 01.01.02.141 - Authenticated Arbitrary Command Injection" webapps cgi "Gabriele Zuddas"
2020-10-29 "Mailman 1.x > 2.1.23 - Cross Site Scripting (XSS)" webapps cgi "Valerio Alessandroni"
2020-04-23 "Zen Load Balancer 3.10.1 - Directory Traversal (Metasploit)" webapps cgi "Dhiraj Mishra"
2020-04-10 "Zen Load Balancer 3.10.1 - 'index.cgi' Directory Traversal" webapps cgi "Basim Alabdullah"
2020-03-30 "Zen Load Balancer 3.10.1 - Remote Code Execution" webapps cgi "Cody Sixteen"
2020-02-11 "CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting" webapps cgi Luca.Chiou
2019-09-09 "Rifatron Intelligent Digital Security System - 'animate.cgi' Stream Disclosure" webapps cgi LiquidWorm
2019-07-12 "Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass / Remote Command Execution" webapps cgi "Chris Lyne"
2019-02-18 "Master IP CAM 01 3.3.4.2103 - Remote Command Execution" webapps cgi "Raffaele Sabato"
2019-02-11 "Smoothwall Express 3.1-SP4 - Cross-Site Scripting" webapps cgi "Ozer Goker"
Release Date Title Type Platform Author
2016-02-03 "Viprinet Multichannel VPN Router 300 - Persistent Cross-Site Scripting" webapps hardware Portcullis
2015-09-25 "X2Engine 4.2 - Cross-Site Request Forgery" webapps php Portcullis
2015-09-25 "X2Engine 4.2 - Arbitrary File Upload" webapps php Portcullis
2015-07-14 "Pimcore CMS Build 3450 - Directory Traversal" webapps xml Portcullis
2015-04-21 "BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File Retrieval/Deletion" webapps cfm Portcullis
2014-12-10 "OpenEMR 4.1.2(7) - Multiple SQL Injections" webapps php Portcullis
2014-10-28 "Enalean Tuleap 7.4.99.5 - Remote Command Execution" webapps php Portcullis
2014-10-28 "Enalean Tuleap 7.4.99.5 - Blind SQL Injection" webapps php Portcullis
2014-10-28 "Enalean Tuleap 7.2 - XML External Entity File Disclosure" webapps php Portcullis
2014-10-02 "PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Execution" webapps php Portcullis
2014-10-02 "TestLink 1.9.11 - Multiple SQL Injections" webapps php Portcullis
2014-06-12 "IBM AIX 6.1.8 - 'libodm' Arbitrary File Write" local aix Portcullis
2014-05-14 "Broadcom PIPA C211 - Sensitive Information Disclosure" webapps hardware Portcullis
2014-04-24 "dompdf 0.6.0 - 'dompdf.php?read' Arbitrary File Read" webapps php Portcullis
2014-03-12 "Procentia IntelliPen 1.1.12.1520 - 'data.aspx' Blind SQL Injection" webapps asp Portcullis
2014-03-12 "vTiger CRM 5.4.0/6.0 RC/6.0.0 GA - 'browse.php' Local File Inclusion" webapps php Portcullis
2014-03-10 "ownCloud 4.0.x/4.5.x - 'upload.php?Filename' Remote Code Execution" webapps multiple Portcullis
2014-03-01 "Oracle Demantra 12.2.1 - SQL Injection" webapps windows Portcullis
2014-03-01 "Oracle Demantra 12.2.1 - Persistent Cross-Site Scripting" webapps windows Portcullis
2014-03-01 "Oracle Demantra 12.2.1 - Arbitrary File Disclosure" webapps windows Portcullis
2014-03-01 "Oracle Demantra 12.2.1 - Database Credentials Disclosure" webapps windows Portcullis
2008-05-11 "ScrewTurn Software ScrewTurn Wiki 2.0.x - 'System Log' Page HTML Injection" webapps php Portcullis
2008-05-08 "SAP Internet Transaction Server 6200.1017.50954.0 Bu (WGate) - 'wgate.dll?~service' Cross-Site Scripting" webapps cgi Portcullis
2008-05-08 "SAP Internet Transaction Server 6200.1017.50954.0 - Bu query String JavaScript Splicing Cross-Site Scripting" webapps cgi Portcullis 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected