PT-2002-1940 · Myhelpdesk · Myhelpdesk

Publicado

2002-08-31

·

Atualizado

2008-09-05

·

CVE-2002-0931

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: MyHelpDesk version 20020509
Description: The issue allows remote attackers to execute script as other users. This can be achieved via a Title or Description when a new ticket is created by a support assistant. The "id" parameter to the index.php script is also vulnerable, specifically with the tickettime, ticketfiles, or updateticketlog operations. Additionally, the update section when a ticket is edited is affected.
Recommendations: For MyHelpDesk version 20020509, consider disabling the ability to create new tickets or edit existing ones until a fix is available. Restrict access to the index.php script to minimize the risk of exploitation. Avoid using the id parameter in the index.php script until the issue is resolved. As a temporary workaround, limit the functionality of the update section when a ticket is edited.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2002-0931

Produtos afetados

Myhelpdesk