PT-2007-6712 · Oneorzero · Oneorzero Helpdesk

Joseph · Publicado 2007-10-30 · Atualizado 2018-10-15 · CVE-2007-5727

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OneOrZero Helpdesk versions 1.6.4.2 through 1.6.5.4

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) "tcreate.php" or (2) "tupdate.php". This can be achieved using events such as onmouseover in a b tag.

Recommendations For OneOrZero Helpdesk versions 1.6.4.2 through 1.6.5.4, consider disabling the stripScripts function in common.php until a patch is available, and restrict access to the "tcreate.php" and "tupdate.php" endpoints to minimize the risk of exploitation. Avoid using the description parameter in these endpoints until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5727

Produtos afetados

Oneorzero Helpdesk

Referências · 8

• http://secunia.com/advisories/27415 · Aviso do Fabricante
• http://securityreason.com/securityalert/3320 · Nota
• http://osvdb.org/38836 · Nota
• http://securityfocus.com/bid/26208 · Nota
• http://securityfocus.com/archive/1/482790/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5727 · Nota de Segurança
• http://osvdb.org/38215 · Nota
• http://securityfocus.com/bid/26217 · Nota