header-logo
Suggest Exploit
vendor:
Oracle Siebel
by:
Lament
7.5
CVSS
HIGH
Cross-Site Scripting
79
CWE
Product Name: Oracle Siebel
Affected Version From: 7.7
Affected Version To: 7.8
Patch Exists: NO
Related CWE: Unknown
CPE: a:oracle:siebel:7.7
Metasploit:
Other Scripts:
Platforms Tested:
Unknown

Cross-Site Scripting Vulnerability in Oracle Siebel

An attacker can execute arbitrary script code in the browser of an unsuspecting user by injecting malicious code through user-supplied input. This can lead to the theft of authentication credentials and other attacks.

Mitigation:

Oracle Siebel should properly sanitize user-supplied input to prevent cross-site scripting attacks.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/38456/info

Oracle Siebel is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Oracle Siebel 7.7 and 7.8 are vulnerable; other versions may also be affected. 

http://www.example.com/htim_enu/start.swe/?>'"><script>alert('XSS by Lament')</script>