SAP Internet Graphics Server PARAMS Cross Site Scripting Vulnerability

Bugtraq ID:	24775
Class:	Input Validation Error
CVE:	CVE-2007-3613
Remote:	Yes
Local:	No
Published:	Jul 05 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Mark Litchfield is credited with the discovery of this vulnerability.
Vulnerable:	SAP Internet Graphics Server 6.40 Patch 11 SAP Internet Graphics Server 6.40 SAP Internet Graphics Server 7.00 Patch 3 SAP Internet Graphics Server 7.00 Patch 2 SAP Internet Graphics Server 7.00 Patch 1 SAP Internet Graphics Server 6.40 Patch 15 SAP Internet Graphics Server 6.40 Patch 14 SAP Internet Graphics Server 6.40 Patch 13 SAP Internet Graphics Server 6.40 Patch 12
Not Vulnerable:	SAP Internet Graphics Server 7.00 Patch 4 SAP Internet Graphics Server 6.40 Patch 16

SAP Internet Graphics Server PARAMS Cross Site Scripting Vulnerability

SAP Internet Graphics Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

SAP Internet Graphics Server PARAMS Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

The following example URI is available:

• /data/vulnerabilities/exploits/24775.html

SAP Internet Graphics Server PARAMS Cross Site Scripting Vulnerability

Solution:
The vendor released fixes to address this issue. Please contact the vendor for information on obtaining and applying fixes.

SAP Internet Graphics Server PARAMS Cross Site Scripting Vulnerability

References:

• SAP Homepage (SAP)
  
• SAP Internet Graphics Server XSS and Heap Overflow (Mark Litchfield)