medium4.3Public exploit code
CVE-2005-3397
Cross-site scripting (XSS) vulnerability in Comersus BackOffice allows remote attackers to inject arbitrary web script or HTML via the error parameter to comer…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Comersus Backoffice 4.x/5.0/6.0 - 'comersus_Backoffice_supportError.asp?error' Cross-Site Scripting2005-10-31 · webapps · asp · Verified
Impact
Cross-site scripting (XSS) vulnerability in Comersus BackOffice allows remote attackers to inject arbitrary web script or HTML via the error parameter to comersus_backoffice_supportError.asp. NOTE: the comersus_backoffice_message.asp/message vector is already covered by CVE-2005-2191 item 2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Comersus Open Technologies | Comersus Backoffice Lite | All versions Versions 4.2, 4.5, 4.10, 4.11, 4.30 |
| Comersus Open Technologies | Comersus Backoffice Plus | All versions Versions 4.2, 4.5, 4.10, 4.11, 4.30 |