medium4.0Public exploit code
CVE-2006-0731
WmRoot/adapter-index.dsp in SAP Business Connector Core Fix 7 and earlier allows remote attackers to conduct spoofing (phishing) attacks via an absolute URL in…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SAP Business Connector 4.6/4.7 - 'adapter-index.dsp?url' Arbitrary Site Redirect2006-02-15 · remote · linux · Verified
- SAP Business Connector 4.6/4.7 - 'deleteSingle?fullName' Arbitrary File Deletion2006-02-15 · remote · linux · Verified
- SAP Business Connector 4.6/4.7 - 'chopSAPLog.dsp?fullName' Arbitrary File Disclosure2006-02-15 · remote · linux · Verified
Impact
WmRoot/adapter-index.dsp in SAP Business Connector Core Fix 7 and earlier allows remote attackers to conduct spoofing (phishing) attacks via an absolute URL in the url parameter, which loads the URL inside a frame.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Business Connector | through core_fix_7 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/18880
- http://securitytracker.com/id?1015639
- http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Phishing_Vector_in_SAP_BC.pdf
- http://www.securityfocus.com/archive/1/425056/100/0/threaded
- http://www.securityfocus.com/archive/1/434012/30/4980/threaded
- http://www.securityfocus.com/bid/16671
- http://www.vupen.com/english/advisories/2006/0611
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24751
- http://secunia.com/advisories/18880
- http://securitytracker.com/id?1015639
- http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Phishing_Vector_in_SAP_BC.pdf
- http://www.securityfocus.com/archive/1/425056/100/0/threaded
- http://www.securityfocus.com/archive/1/434012/30/4980/threaded
- http://www.securityfocus.com/bid/16671
- http://www.vupen.com/english/advisories/2006/0611
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24751