cbcvebase.
CVE-2011-1976
published 2011-08-10

CVE-2011-1976: Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote attackers to…

PriorityP430medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
20.81%
97.3th percentile
Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote attackers to inject arbitrary web script or HTML via a parameter in a data source, aka "Report Viewer Controls XSS Vulnerability."

Affected

2 ranges
VendorProductVersion rangeFixed in
microsoftreport_viewer——
microsoftvisual_studio——

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://www.example.com/Reserved.ReportViewerWebControl.axd?Mode=true&ReportID=%3CarbitraryIDvalue%3E&ControlID=%3CvalidControlID%3E&Culture=1033&UICulture=1033&ReportStack=1&OpType=SessionKeepAlive&TimerMethod=KeepAliveMethodctl00_PlaceHolderMain_SiteTopUsersByHits_ctl00TouchSession0;alert(document.cookie);//&CacheSeed=↗
path/Reserved.ReportViewerWebControl.axd↗
  • →Monitor HTTP requests targeting the Reserved.ReportViewerWebControl.axd handler for XSS payloads injected into the 'TimerMethod' parameter, particularly patterns containing semicolons followed by JavaScript (e.g., alert, document.cookie) within the parameter value. ↗
  • →The OpType parameter value 'SessionKeepAlive' combined with script injection in the TimerMethod parameter is the specific attack pattern for this CVE; alert on requests to .axd endpoints where TimerMethod contains semicolons or JavaScript keywords. ↗
  • →The vulnerability is exploitable via a parameter in a data source of the Report Viewer Control; inspect all parameters passed to Reserved.ReportViewerWebControl.axd for unsanitized HTML/script content. ↗
  • ·The example URL uses 'www.example.com' as a placeholder; the actual target host will vary per deployment. Substitute the real hostname of the vulnerable Report Viewer application when building detection signatures. ↗
  • ·Affected products are specifically Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1; detections should be scoped to environments running these versions. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.