Description
Multiple cross-site scripting (XSS) vulnerabilities in AdventNet ManageEngine OpManager 6 and 7 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter in (a) ping.do and (b) traceRoute.do in map/; the (2) reportName, (3) displayName, and (4) selectedNode parameters to (c) reports/ReportViewAction.do; the (5) operation parameter to (d) admin/ServiceConfiguration.do; and the (6) selectedNode and (7) selectedTab parameters to (e) admin/DeviceAssociation.do. NOTE: the searchTerm parameter in Search.do is already covered by CVE-2006-2343.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 5
- OpManager 6/7 - 'ping.do?name' Cross-Site Scripting EDB-30271 · webapps · Jul 4, 2007 · verified
- OpManager 6/7 - 'traceRoute.do?name' Cross-Site Scripting EDB-30272 · webapps · Jul 4, 2007 · verified
- OpManager 6/7 - reports/ReportViewAction.do Multiple Cross-Site Scripting Vulnerabilities EDB-30273 · webapps · Jul 4, 2007 · verified
- OpManager 6/7 - 'admin/ServiceConfiguration.do?Operation' Cross-Site Scripting EDB-30274 · webapps · Jul 4, 2007 · verified
- OpManager 6/7 - '/admin/DeviceAssociation.do' Multiple Cross-Site Scripting Vulnerabilities EDB-30275 · webapps · Jul 4, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 24767 vdb-entry
- 38949 vdb-entry
- 37825 vdb-entry
- http://lostmon.blogspot.com/2007/07/netflow-analizer-5-opmanager-7-multiple.html
- 38947 vdb-entry
- 37821 vdb-entry
- 38946 vdb-entry
- 37824 vdb-entry
- 37822 vdb-entry
- 38945 vdb-entry
- 38948 vdb-entry
- netflowanalyzer-opmanager-multiple-xss(35263) vdb-entry
- 37823 vdb-entry