SAP Web Application Server Multiple Cross-Site Scripting Vulnerabilities

vendor:

SAP Web Application Server

by:

Unknown

7.5

CVSS

HIGH

Cross-Site Scripting

CWE

Product Name: SAP Web Application Server

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: YES

Related CWE:

CPE: a:sap:web_application_server

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

SAP Web Application Server Multiple Cross-Site Scripting Vulnerabilities

The SAP Web Application Server is prone to multiple cross-site scripting vulnerabilities. These issues occur due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user within the affected site's context. This can lead to the theft of cookie-based authentication credentials and other attacks.

Mitigation:

To mitigate these vulnerabilities, it is recommended to apply the latest patches and updates provided by SAP. Additionally, web application developers should implement proper input validation and output encoding to prevent cross-site scripting attacks.

Source

Exploit-DB raw data:

<!DOCTYPE html>
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<link rel="stylesheet" href="https://cdn.sucuri.net/sucuri-firewall-block.css" />
<section class="center clearfix">
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Sucuri WebSite Firewall - Access Denied</title>
<link href="https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700" rel="stylesheet" type="text/css">
</head>
<body>
<div id="main-container">
<header class="app-header clearfix">
<div class="wrap">
<a href="https://www.sucuri.net/?utm_source=firewall_block" class="logo"></a>
<span class="logo-neartext">Website Firewall</span>
<a href="https://sucuri.net/?utm_source=firewall_block" class="site-link">Back to sucuri.net</a>
</div>
</header>

<section class="app-content clearfix">
<div class="box">
<p class="medium-text">This page you are trying to visit is protected by an automated security check. Please complete the check below to verify your browser and proceed.</p>

<style>
.cap-spin{width:20px;height:20px;border:2px solid #d7ede0;border-top-color:#2e7d32;border-radius:50%;display:inline-block;animation:capspin .7s linear infinite;}
@keyframes capspin{to{transform:rotate(360deg);}}
#cap-widget:focus{outline:2px solid #b9c7ff;outline-offset:2px;}
</style>
<script>
var _cs="d70bc737d9a15ecada1b3db1a6b1458a";
var _cd=4;
var _ce=1786450054;
var _cg="b99d5c1aff7b617555a2bf1ebd1a495ce5794a68130f99d63bb017541643e9c0";
var _capBusy=false;
function _hex(b){return Array.from(new Uint8Array(b)).map(function(x){return x.toString(16).padStart(2,'0');}).join('');}
async function _sha(s){return _hex(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(s)));}
function _capState(s){var i=document.getElementById('cap-ind'),l=document.getElementById('cap-label'),w=document.getElementById('cap-widget');if(s==='verifying'){i.innerHTML='<span class="cap-spin"></span>';l.textContent='Verifying...';w.style.cursor='default';}else if(s==='done'){i.innerHTML='<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="#2e7d32" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"><polyline points="20 6 9 17 4 11"></polyline></svg>';l.textContent="You're a human";w.style.cursor='default';w.setAttribute('aria-checked','true');}}
async function capSolve(){if(_capBusy)return;_capBusy=true;_capState('verifying');var _t0=Date.now();var p=Array(_cd+1).join('0');var n=0;while(true){var h=await _sha(_cs+n);if(h.slice(0,_cd)===p){break;}n++;}document.getElementById('cap-token').value=_cs+':'+_cd+':'+_ce+':'+_cg+':'+n;var _w=800-(Date.now()-_t0);if(_w<0)_w=0;setTimeout(function(){_capState('done');var b=document.getElementById('cap-proceed');if(b){b.disabled=false;b.style.opacity='1';b.style.cursor='pointer';b.focus();}},_w);}
</script>
</br></br>
<form method="post" id="captchaform">
<input type="hidden" name="cap-token" id="cap-token" value="" />
<div id="cap-widget" role="checkbox" aria-checked="false" tabindex="0" onclick="capSolve()" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();capSolve();}" style="display:inline-flex;align-items:center;gap:12px;background:#fff;border:1px solid #d3d3d3;border-radius:8px;padding:14px 18px;min-width:260px;cursor:pointer;box-shadow:0 1px 2px rgba(0,0,0,0.08);text-align:left;">
<span id="cap-ind" style="width:24px;height:24px;flex:0 0 24px;display:inline-flex;align-items:center;justify-content:center;"><span style="width:22px;height:22px;border:2px solid #c2c2c2;border-radius:4px;box-sizing:border-box;display:inline-block;"></span></span>
<span id="cap-label" style="flex:1;font-size:15px;color:#333;">Verify you&#39;re human</span>
</div>
<div><button type="submit" id="cap-proceed" class="btn btn-primary ajax-form brand-font" disabled style="margin-top:16px;opacity:.5;cursor:not-allowed;">Click to Proceed to Page</button></div>
</form>
</br></br>
<p class="what-is-firewall">
<a href="https://sucuri.net/website-firewall/?utm_source=firewall_block">Sucuri Website Firewall</a> is a cloud-based protection that
stands between your site and the rest of the world and protects against attacks,
malware infections, DDOS, brute force attempts and mostly anything that can harm it.</p>
</div>
</section>

<footer>
<span>&copy; 2026 Sucuri Inc. All rights reserved.</span>
<span id="privacy-policy"><a href="https://sucuri.net/privacy-policy?utm_source=firewall_block" target="_blank" rel="nofollow noopener">Privacy</a></span>
</footer>
</div>
</body>
</html>