Description
WmRoot/adapter-index.dsp in SAP Business Connector Core Fix 7 and earlier allows remote attackers to conduct spoofing (phishing) attacks via an absolute URL in the url parameter, which loads the URL inside a frame.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- SAP Business Connector 4.6/4.7 - 'chopSAPLog.dsp?fullName' Arbitrary File Disclosure EDB-27233 · remote · Feb 15, 2006 · verified
- SAP Business Connector 4.6/4.7 - 'deleteSingle?fullName' Arbitrary File Deletion EDB-27234 · remote · Feb 15, 2006 · verified
- SAP Business Connector 4.6/4.7 - 'adapter-index.dsp?url' Arbitrary Site Redirect EDB-27235 · remote · Feb 15, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 18880 third-party-advisory
- 20060515 CYBSEC - Security Advisory: Phishing Vector in SAP BC (BusinessConnector) mailing-list
- 1015639 vdb-entry
- 16671 vdb-entry
- 20060215 CYBSEC - Security Pre-Advisory: Phishing Vector in SAP BC mailing-list
- http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Phishing_Vector_in_SAP_BC.pdf
- ADV-2006-0611 vdb-entry
- sapbc-admin-spoofing(24751) vdb-entry