This was almost a year ago, myself along with Neel and other team members were working on product configurator and found vulnerability in the siebel browser script.
Like other web applications, In Siebel also we can inject some javascript in page to extract details or modify some element. But as siebel has provided access to the theApplication() object in the browser script. We could access it in script in address bar.
Once this object was availble, we were able to set and get profile attribute at any view in the siebel session.
That's not all !! Siebel script engine doesn't defferentiate between a browser script and server script. The only difference is that in browser script user can only work on the objects that are shown on the current UI.
This means that we can edit the read only fields, those fields that were made readonly at applet level.
I digged some more and uploaded some scripts that can be used readily in any application.
Try one of the followings:
(Open siebel application and copy paste the content in the address bar and click GO.)
1.
3.
