PT-2008-2230 · Astrosoft · Astrosoft Helpdesk

Alexandr Polyakov + 1 · Publicado 2008-02-06 · Atualizado 2018-10-15 · CVE-2008-0605

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AstroSoft HelpDesk versions prior to 1.95.228

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the txtSearch parameter to the "operator/article/article search results.asp" endpoint and the Attach Id parameter to the "operator/article/article attachment.asp" endpoint. For the second vector, the XSS occurs in a forced SQL error message.

Recommendations For versions prior to 1.95.228, update to version 1.95.228 or later to resolve the issue. As a temporary workaround, consider restricting access to the txtSearch parameter in the "operator/article/article search results.asp" endpoint and the Attach Id parameter in the "operator/article/article attachment.asp" endpoint until a patch is available. Avoid using the txtSearch and Attach Id parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-0605

Produtos afetados

Astrosoft Helpdesk

Referências · 7

• 🔥 https://exploit-db.com/exploits/31103 · Exploit
• 🔥 https://exploit-db.com/exploits/31104 · Exploit
• 🔥 http://securityfocus.com/bid/27610 · Exploit
• http://securityfocus.com/archive/1/487487/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0605 · Nota de Segurança
• http://securityreason.com/securityalert/3612 · Nota
• http://securityfocus.com/archive/1/488107/100/0/threaded · Nota