PT-2009-6554 · Idevspot · Idevspot Isupport

Essandre

+1

·

Publicado

2009-12-28

·

Atualizado

2017-08-17

·

CVE-2009-4433

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions IDevSpot iSupport versions 1.8 and earlier
Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This can be achieved through various means, including the "5" or "9" field in a post action to "ticket function.php", the "which" parameter to "function.php", or the "which" parameter to "index.php". These endpoints are reachable through "ticket submit.php" and "index.php", and are related to "knowledgebase list.php".
Recommendations For IDevSpot iSupport versions 1.8 and earlier, consider disabling access to the vulnerable endpoints, such as "ticket function.php", "function.php", and "index.php", until a fix is available. Additionally, restrict the use of the "which" parameter and the "5" and "9" fields in post actions to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-4433

Produtos afetados

Idevspot Isupport